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ABSTRACT 

The  role  of  maintenance  in  a  nuclear  power  plant  is  to  ensure  that  plant  equipment 
is  kept  at  a  proper  level  of  functionality,  thus  increasing  the  level  of  overall  plant  safety. 

In  a  deregulated  electricity  market,  nuclear  power  plants  must  remain  competitive  with 
conventional  utilities  in  the  production  of  electricity.  Consequently,  nuclear  utilities  must 
find  ways  to  improve  their  operations  and  reduce  costs  without  sacrificing  the  level  of 
overall  plant  safety  and  relationships  with  its  stakeholders.  One  area  of  operations  in 
which  nuclear  utilities  can  gain  a  competitive  edge  is  in  the  maintenance  of  its  power 
plants.  By  reducing  the  frequency  of  preventive  maintenance  and  shifting  the 
performance  of  selected  maintenance  items  on-line,  the  utilities  are  able  to  reduce  costs 
without  significant  impact  to  plant  safety  and  relations  to  stakeholders. 

This  study  focuses  on  the  maintenance  of  hydraulic  control  units  (HCUs)  in 
Tokyo  Electric  Power  Company’s  (TEPCO)  boiling  water  reactors  (BWRs).  Using 
Multi- Attribute  Utility  Theory  (MAUT),  TEPCO  decision  makers  can  obtain  a  rank¬ 
ordering  of  multiple  decision  options  based  on  their  current  preferences  toward  safety, 
cost,  and  stakeholder  relations.  In  the  case  of  HCU  maintenance,  the  decision  options 
considered  are  performance  of  HCU  maintenance  in  the  following  conditions:  1)  on-line 
with  outage  duration  unchanged,  2)  off-line  with  outage  duration  unchanged,  3)  on-line 
with  outage  duration  shortened,  and  4)  off-line  with  outage  duration  shortened.  Because 
these  options  could  have  varying  effects  on  safety,  cost,  and  stakeholder  relations,  the  use 
of  MAUT  facilitates  decision  making  by  providing  a  methodology  that  considers  the 
effect  of  multiple  factors  simultaneously. 

The  literature  search  produced  some  useful  information  with  regard  to  the 
maintenance  practices  of  utilities  from  different  countries,  leading  to  a  better 
understanding  of  maintenance  philosophy,  regulation,  and  routine  in  Japan.  In  addition, 
the  search  provided  a  wealth  of  information  on  the  HCU  maintenance  practices  of  US 
utilities  and  the  predominant  failure  modes  observed  in  the  system. 
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Through  the  use  of  performance  indices,  the  desirability  of  each  maintenance 
option  can  be  quantified.  The  results  of  the  study  indicate  that  the  best  option  is  to 
perform  on-line  maintenance  of  the  HCUs  under  the  condition  of  a  shorter  outage.  This 
option  yielded  the  lowest  overall  performance  index,  indicating  the  lowest  expected 
“disutility”  among  the  other  decision  options. 


Thesis  Supervisor:  Michael  W.  Golay 
Title:  Professor  of  Nuclear  Engineering 
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Introduction 


1.1  General 

The  function  of  the  hydraulic  control  units  (HCUs)  in  boiling  water  reactors 
(BWRs)  is  to  provide  high  pressure  water  for  reactor  scrams  and  to  provide  the  hydraulic 
power  necessary  to  move  reactor  control  rods.  By  virtue  of  their  importance  to  reactor 
safety,  the  HCUs  are  relied  upon  to  perform  their  function  100%  of  the  time.  Needless  to 
say,  the  tolerance  for  failure  of  the  HCUs  is  very  low  and  the  maintenance  requirements 
are  stringent. 

In  the  United  States,  most  nuclear  utilities  perform  preventive  and  corrective 
maintenance  for  the  HCUs  on-line  (while  the  reactor  is  operating).  This  effort  by  US 
utilities  to  shift  HCU  maintenance  on-line  has  resulted  in  shorter  refueling  outage 
durations,  lower  costs  associated  with  refueling  maintenance,  a  levelized  workforce,  and 
the  ability  to  devote  more  resources  to  critical  path  items  during  refueling  [1].  In  Japan, 
all  HCU  maintenance  is  currently  performed  during  refueling  outages.  Most  work 
performed  is  preventive  maintenance,  and  the  problem  this  practice  presents  is  that  HCU 
maintenance  performed  off-line  overburdens  plant  management,  operators,  and 
maintenance  personnel.  In  addition,  off-line  HCU  maintenance  contributes  greatly  to  the 
spike  of  employment  during  refueling  outages,  resulting  in  a  maintenance  work  force  that 
is  not  utilized  during  normal  plant  operation. 

On-line  HCU  maintenance  in  the  United  States  was  accepted  purely  on 
deterministic  analysis  by  plant  utilities  [2],  with  no  explicit  risk  assessments  being 
performed.  Utility  executives  were  convinced  that  on-line  HCU  maintenance  was  safe 
and  beneficial  because  of  the  following  reasons  [3]: 

1 .  All  General  Electric  BWR  HCUs  are  designed  to  be  isolable,  thereby  easing  the 
concern  for  industrial  safety. 
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2.  Off-line  HCU  maintenance  was  expensive,  requiring  the  employment  of  contractors  to 
perform  the  maintenance.  On-line  maintenance  allowed  the  use  of  plant  personnel  for  the 
performance  of  maintenance. 

3.  The  impact  to  plant  operations  and  replacement  power  cost  was  minimized  by 
coordinating  on-line  maintenance  with  low  power  demand  periods. 

This  study  utilizes  HCU  maintenance  as  a  case  study  for  multi-attribute  utility 
theory  (MAUT)  and  how  TEPCO  can  utilize  MAUT  in  analyzing  its  decision  options. 
Using  this  method,  the  favorability  of  the  on-line  and  off-line  HCU  maintenance  options 
are  quantified. 

1.2  Background 


In  an  effort  to  enhance  competitiveness  in  a  deregulated  electricity  market, 
nuclear  power  plant  producers  must  find  ways  to  reduce  costs  while  maintaining  safety 
and  stakeholder  confidence.  In  Japan,  Tokyo  Electric  Power’s  stakeholders  are  the 
Ministry  of  Economy,  Trade,  and  Industry  (METI)  (governmental  regulator),  the  local 
government,  local  workers,  and  the  public.  All  decisions  made  must  take  into  account 
the  effect  not  only  on  safety  and  economics  but  also  the  effect  on  stakeholder 
relationships. 

In  recent  years,  there  has  been  growing  suspicion  with  nuclear  power  as  the 
general  public  has  witnessed  the  Tokai-mura  criticality  accident  and  as  the  media 
uncovered  a  scandal  at  the  Monju  fast  breeder  reactor.  As  a  result  of  these  incidents,  the 
credibility  of  the  nuclear  industry  in  Japan  has  suffered,  making  the  utility’s  decision¬ 
making  process  even  more  complicated  as  the  stakeholders’  acceptance  of  nuclear  power 
wanes  [4]. 

For  optimal  decision-making,  the  utility  must  take  all  of  these  factors  into 
account.  To  satisfy  many  objectives  (i.e.  maintain  safety  to  general  public,  maintain 
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good  relations  with  stakeholders,  and  reduce  expenses),  the  decision  makers  must 
carefully  consider  all  consequences  a  specific  decision  could  have.  Because  human 
beings  are  not  consistent  when  making  decisions  involving  multiple  factors,  a 
methodology  is  necessary  to  aid  the  decision  maker  in  this  task.  In  this  study,  MAUT 
provides  a  good  analytical  tool  to  determine  which  decision  option  is  best. 

1.3  Objective 

The  objective  of  the  study  is  to  rank  the  desirability  of  the  following  decision 
options  for  HCU  maintenance,  using  MAUT: 

1 .  On-line  maintenance  with  no  change  in  outage  duration 

2.  Off-line  maintenance  with  no  change  in  outage  duration 

3.  On-line  maintenance  with  a  shortened  outage 

4.  Off-line  maintenance  with  a  shortened  outage. 

1.4  Method  of  Investigation 

The  first  step  in  the  development  of  a  ranking  of  decision  options  for  HCU 
maintenance  was  to  gain  a  comprehensive  understanding  of  the  HCUs.  We  learned  how 
the  HCUs  are  constructed,  their  modes  of  operation,  failure  modes,  and  degradation 
mechanisms.  Using  this  information,  along  with  expert  judgment  provided  by  a  visiting 
TEPCO  engineer,  we  constructed  fault  trees  for  the  failure  events  we  determined  to  be 
most  important  in  our  analysis.  These  failure  events  (also  known  as  Top  Events)  are  as 
follows: 

1 .  Excessive  Scram  Time 

2.  Failure  to  Scram 

3.  Inadvertent  Control  Rod  Movement  Inward 

4.  Inadvertent  Control  Rod  Movement  Outward 

5.  Failure  to  Move  Control  Rod  Inward 

6.  Failure  to  Move  Control  Rod  Outward. 
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Because  HCU  failure  data  from  TEPCO  was  unavailable,  we  used  data  provided  by  the 
Institute  of  Nuclear  Power  Operations  (INPO)  from  the  Nuclear  Plant  Reliability  Data 
System  (NPRDS)  database  to  determine  probabilities  for  each  top  event. 

Figure  1.1  shows  the  overall  methodological  structure  for  characterizing 
TEPCO’s  decision  making  values  developed  by  Koser,  Sato,  et  al  [4],  It  consists  of  the 
value  tree,  the  utility  analysis,  and  the  decision  options.  The  value  tree  is  a  hierarchical 
representation  of  the  objectives  that  support  the  decision-making  process  [5]  and  is  a 
reflection  of  what  factors  the  decision  maker  must  consider  when  weighing  various 
decision  options.  The  utility  analysis  consists  of  an  examination  of  the  effect  of  each 
decision  option  on  the  performance  measures  represented  in  Tier  5  of  Figure  1.1.  Finally, 
the  decision  options  for  this  case  study  are  listed  in  Section  1.3. 

In  order  to  rank  the  favorability  of  each  decision  option,  we  used  MAUT  to 
provide  a  quantity  called  the  Performance  Index  (PI),  known  in  standard  MAUT 
textbooks  as  the  “Expected  Utility.”  The  PI  is  calculated  for  each  decision  option  and  the 
option  with  the  lowest  PI  is  the  most  favorable  one. 

1.5  Terminology 

The  following  terms  are  used  in  this  study: 

1 .  Critical  Path:  The  sequence  of  operations  that  must  be  performed  serially  during  a 
refueling  outage.  Items  on  critical  path,  if  not  completed,  will  prevent  the  plant  from 
returning  to  full  operational  status. 

2.  On-line  maintenance:  Maintenance  that  is  performed  while  the  plant  is  operating. 

3.  Off-line  maintenance:  Maintenance  that  is  performed  while  the  plant  is  shutdown, 
typically  during  refueling  outages. 

4.  Technical  Specifications:  Specifications  that  define  limits  and  conditions  to  assure 
nuclear  power  plants  are  operated  in  a  manner  consistent  with  the  analyses  and 
evaluations  in  the  plant’s  Safety  Analysis  Report.  [6] 
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5.  Corrective  Maintenance:  The  actions  needed  to  restore  the  operability  of  failed  or 
degraded  equipment  within  acceptable  limits.  These  actions  include  repairs  or 
replacement  for  failed  equipment  and  maintenance  actions  for  those  degradations  where 
immediate  corrective  actions  are  preferred.  [6] 


6.  Preventive  Maintenance:  The  actions  that  detect,  preclude,  or  mitigate  degradation  of 
a  functional  component  to  sustain  or  extend  its  useful  life  by  controlling  degradation  and 
failures  at  an  acceptable  level.  [6] 


7.  Scram:  The  rapid  emergency  shutdown  of  a  nuclear  reactor  by  rapid  insertion  of  all 
control  rods. 

8.  Nuclear  Plant  Reliability  Data  System  (NPRDS):  A  computer-based  collection  of 
engineering,  operational,  and  failure  data  on  systems  and  components  installed  in  U.S. 
nuclear  plants.  The  NPRDS  can  help  improve  plant  equipment  performance  in  a  number 
of  ways,  including  the  following:  [7] 

•  Identifying  high-failure-rate  equipment, 

•  Identifying  plants  that  have  a  particular  equipment  problem, 

•  Identifying  plants  with  possible  spare  parts  and  equipment  that  could  be  made 
available  to  other  plants, 

•  Selecting  vendors  and  equipment  for  plant  modifications  based  on  component 
reliability, 

•  Optimizing  spare  parts  inventory  based  on  failure  rates  and  replacement  history, 

•  Scheduling  and  defining  preventive  and  predictive  maintenance  activities, 

•  Providing  input  to  plant  availability  studies, 

•  Providing  data  for  reliability-centered  maintenance  programs. 


17 


C  Decision  Options^) 


Figure  1.1 — Overall  Methodological  Structure  for  Characterizing  TEPCO’s 

Decision  Making  Values  [4] 
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Literature  Search 


2.1  General 

This  section  summarizes  the  literature  search  performed  to  gain  familiarity  with 
the  maintenance  practices  of  Japan  and  how  they  differ  in  comparison  to  maintenance 
practices  of  the  US. 

2.2  Overview  of  Japanese  Nuclear  Industry  Maintenance  Practices 

2.2.1  Industry  Description 

Nuclear  power  currently  supplies  approximately  36%  of  the  power  consumed  in 
Japan — it  ranks  3rd  in  the  world  in  total  capacity.  There  are  51  operating  plants  (23 
PWRs  and  28  BWRs)  [8]  and  because  of  Japan’s  limited  resources,  nuclear  power 
promises  to  play  an  even  bigger  role  in  the  future  as  the  country  seeks  independence  from 
foreign  sources  of  fuel.  [9]  The  Japanese  public  places  a  great  deal  of  emphasis  on  safety 
in  the  nuclear  industry  and  on  minimizing  radiation  exposure  to  workers  and  to  the 
public. 

2.2.2  Regulatory  Structure 

The  Japanese  Fundamental  Act  of  1955  delegated  responsibility  for  regulation  of 
commercial  nuclear  reactors  to  the  Ministry  of  Economy,  Trade  and  Industry  (METI). 
Once  known  as  the  Ministry  of  International  Trade  and  Industry  (MITI),  it  traces  its 
regulatory  jurisdiction  of  maintenance  at  commercial  nuclear  power  plants  to  the  Electric 
Utility  Industry  Law  and  the  Law  for  the  Regulation  of  Nuclear  Source  Materials,  Fuel 
Materials,  and  Reactors.  [10] 
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The  Electric  Industry  Law  sets  forth  the  technical  standards  for  the  installation, 
operation,  and  maintenance  of  electrical  structures;  in  addition,  this  law  also  mandates  the 
periodic  inspection  which  occurs  during  scheduled  outages  for  inspection  and 
maintenance. 

2.2.3  Maintenance  Practices  and  Regulations 

Japan’s  structured,  industiy-wide  program  of  preventive  maintenance  consists  of 
four  basic  elements:  1)  statutory  annual  inspection,  2)  voluntary  internal  inspection,  3) 
special  work,  including  backfitting  and  corrective  maintenance,  and  4)  routine  inspection. 
The  first  three  are  conducted  during  the  annual  inspection  (required  at  least  every  13 
months)  and  the  last  is  conducted  during  routine  plant  operation.  [10] 

During  the  outage,  approximately  70  items  in  the  plant  are  disassembled  and 
inspected.  Although  the  duration  of  outages  is  decreasing  because  of  more  efficient 
inspection  procedures  [11],  technical  improvements  in  maintenance  and  repair,  and 
extensive  education  and  training  programs,  the  average  outage  duration  in  Japan  is  90 
days  [12].  In  the  United  States,  outages  are  as  short  as  20  days. 

Preventive  maintenance  on  plant  components  is  also  performed  during  outages, 
and  the  Japanese  preventive  maintenance  program  is  so  effective  that  plants  are  seldom 
required  to  shut  down  during  plant  operation  to  fix  problems. 

2.3  Comparison  of  US  and  Japanese  Maintenance  Practices 

2.3.1  Technical  Specifications 

In  the  United  States,  technical  specifications  delineate  preventive  maintenance 
requirements  that  are  largely  operational  in  nature,  meaning  that  they  are  comprised  of 
functional  tests  and  verification  of  operation  that  are  mostly  performed  during  normal 
operation.  In  contrast,  the  Japanese  perform  extensive  inspections  that  require  complete 
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disassembly  of  components.  Most  of  the  mechanical  inspections  and  functional  tests  are 
performed  during  the  inspection  outages.  Technical  specifications  in  the  United  States 
are  largely  limited  to  safety  related  systems  and  components;  however,  the  Japanese  also 
include  non-safety  related  equipment  such  as  condenser  systems,  feedwater  systems,  and 
turbine  generator  auxiliaries.  In  general,' the  numbers  and  types  of  components  subject  to 
inspection  are  much  greater  than  current  technical  specification  requirements  in  the  US. 

2.3.2  Regulator  Oversight 

In  Japan,  METI  involves  itself  in  the  preventive  maintenance  program  by 
witnessing  a  significant  number  of  maintenance  activities  during  annual  plant  outages. 
There  is  no  requirement  in  the  US  for  the  Nuclear  Regulatory  Commission  to  witness 
maintenance  activities. 

2.3.3  Summary 

Japanese  reactors  experience  significantly  fewer  trips  than  US  reactors  not 
because  of  differences  in  trip  setpoints  or  technical  specifications,  but  due  to  the 
structured,  industry-wide  program  of  extensive  preventive  maintenance.  This  program 
consists  of  statutory  annual  inspections,  voluntary  internal  inspections,  special  work,  and 
routine  inspections.  In  addition,  the  Japanese  regulatory  authority,  METI,  is  heavily 
involved  in  the  maintenance  process  and  witnesses  most  maintenance  activities  during 
each  annual  outage. 
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General  Electric  BWR  Hydraulic  Control  Unit  System 


3.1  Introduction 

This  section  is  devoted  to  familiarizing  the  reader  with  the  HCU  system,  its 
function  and  operation,  degradation  mechanisms,  and  failure  modes.  In  addition,  the 
current  HCU  maintenance  practices  of  Japan  and  the  United  States  will  be  compared  and 
technical  specifications  discussed. 

3.2.  General  Description 

The  HCU  consists  of  all  the  hydraulic,  electrical,  and  pneumatic  equipment 
necessary  to  move  one  control  rod  drive  mechanism  (CRDM)  during  normal  and  scram 
operation.  All  TEPCO  BWR/5s  have  185  HCUs  (The  BWR/4  and  BWR/6  have  137  and 
193  HCUs,  respectively).  Figure  3.1  shows  the  general  construction  of  the  HCUs. 

3.3  Function 

The  HCU  performs  the  following  three  specific  functions:  [13] 

1.  Provides  high  pressure  water  from  the  accumulators  to  enable  the  control  rod 
assemblies  to  scram.  One  HCU  provides  scram  power  for  one  CRDM. 

2.  Contains  the  valve  configuration  for  normal  CRDM  movement  inward  or  outward 
using  solenoid-operated  and  directional  control  valves. 

3.  Provides  cooling  water  flow  path  to  the  CRDM. 
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ISOLATION  VALVE  • 
SCRAM  VALVE  PILOT  AIR 

ISOLATION  VALVE  ■ 
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ISOLATION  VALVE ' 
INSERT  RISER 

ISOLATION  VALVE  * 
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DRIVE  WATER  RISER 

-  SCRAM  PILOT  VALVE  ASSEMBLY 
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(INSERT) 


DIRECTIONAL  CONTROL  VALVE  - 
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ASSEMBLY 


Figure  2-13.  Control  Rod  Drive  Hydraulic  Control  Unit 


Figure  3.1 — Control  Rod  Drive  Hydraulic  Control  Unit  [13] 
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3.4  Main  Components 

The  main  components  of  the  HCU  system  are  as  follows: 

1.  Directional  Control  Valves :  (Valves  120, 121,  122, 123)  These  valves  direct  drive 
and  exhaust  water  for  control  rod  movement.  The  rod  control  and  information  system 
provides  proper  sequencing  and  duration  of  the  signals  used  to  operate  these  valves. 

2.  Scram  Inlet  and  Outlet  Valves:  (Valves  126  and  127,  respectively)  Normally  held 
shut  by  instrument  air  pressure  applied  to  their  actuators,  these  valves  control  water  flow 
for  the  scram  function. 

3.  Scram  Solenoid  Pilot  Valves :  These  valves  control  the  air  that  is  supplied  to  the  scram 
valves.  The  scram  solenoid  valves  are  normally  energized  to  maintain  instrument  air 
pressure  that  keeps  the  scram  valves  shut.  When  a  scram  signal  is  received,  the  solenoids 
deenergize,  venting  instrument  air,  and  allowing  the  scram  valves  to  open  by  spring 
action. 

4.  Scram  accumulators:  The  scram  accumulator  is  a  piston  water  accumulator  that  is 
pressurized  by  a  volume  of  nitrogen  gas  in  a  nitrogen  cylinder.  The  piston  in  the  scram 
accumulator  forms  a  barrier  between  the  high-pressure  nitrogen  gas  used  as  the  source  of 
stored  energy  and  the  water  used  to  initiate  a  scram.  Under  normal  plant  operating 
conditions  the  piston  is  in  full  down  position.  The  control  rod  drive  hydraulic  pump 
continuously  pressurizes  the  scram  accumulators  through  the  charging  water  header. 
Figure  3.2  illustrates  the  components  discussed  above. 

3.5  Operation 

3.5.1  CRDM  Scram  Operation 

When  a  reactor  scram  is  initiated  by  the  reactor  protection  system,  the  control  air 
is  vented  from  the  scram  valves  through  the  deenergization  of  relays  associated  with  the 
scram  solenoid  pilot  valves  (SSPVs).  As  the  air  is  vented,  the  inlet  and  outlet  scram 
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valves  open  by  spring  action.  Opening  the  scram  outlet  valve  reduces  the  pressure  above 
the  main  drive  piston  of  the  CRDM  to  atmospheric  pressure  while  opening  the  scram 
inlet  valves  allows  high  pressure  water  (-1800  psi)  from  the  accumulator  to  the  bottom  of 
the  piston.  Figure  3.3  depicts  this  action. 

3.5.2.  CRDM  Insert  Operation 

The  insert  operation  is  accomplished  by  opening  directional  control  valves  121 
and  123,  as  shown  in  Figure  3.4  When  these  valves  open,  water  from  the  drive  water 
header  applies  drive  water  pressure  to  the  bottom  of  the  control  rod  drive  piston.  At  the 
same  time,  water  above  the  piston  will  flow  to  the  exhaust  header.  The  differential 
pressure  created  across  the  drive  piston  forces  the  control  rod  into  the  core. 

3.5.3  CRDM  Withdraw  Operation 

“The  weight  of  the  control  rod  blade  and  the  index  tube/drive  piston  assembly  is 
approximately  125N  (280  lb)  and  the  tops  of  the  notches  on  the  index  tube  are  square. 
Therefore,  the  friction  between  the  index  tube  notch  and  the  collet  fingers  is  too  great  to 
allow  a  pressure  force  from  the  collet  piston  to  remove  the  fingers  from  the  square 
notches.  So,  initially,  an  insertion  signal  is  applied  for  a  short  time  (0.5s),  which  causes 
the  rod  to  insert.  As  the  rod  inserts,  the  collet  fingers  slide  out  over  the  tapered  bottom  of 
the  notch  in  the  index  tube.”  [14] 

Following  a  brief  insert  signal  that  allows  the  rod  to  disengage  from  the  collett 
fingers,  a  withdraw  signal  opens  directional  control  valves  120  and  122  as  shown  in 
Figure  3.5.  Drive  water  pressure  is  applied  to  the  area  above  the  drive  piston  while  the 
volume  below  the  drive  piston  is  discharged  to  the  exhaust  header.  The  differential 
pressure  created  forces  the  rod  out  of  the  core. 
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EXHAUST  WATER  HEADER 


COOLING  WATER  HEAOER 


Figure  3.2  Control  Rod  Drive  Hydraulic  System  Schematic  Diagram  [15] 
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Figure  3.3  Scram  Operation  Flowpath  [16] 
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Figure  3.4  Insert  Operation  Flowpath  [16] 
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Figure  3.5  Withdraw  Operation  Flowpath  [16] 


3.6  HCU  Component  Failures  and  Degradation  Mechanisms 

Based  on  a  Nuclear  Plant  Aging  Research  (NPAR)  study  that  examined  the  aging 
processes  associated  with  BWR  CRDMs,  it  was  discovered  that  the  HCU  contributed  the 
majority  of  failures  associated  with  the  control  rod  drive  system.  More  than  59%  of  the 
3432  CRD  system  failures  reported  to  the  NPRDS  were  attributed  to  failures  to  HCU 
components  [15].  The  following  is  a  list  of  predominant  HCU  components  failures: 
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1.  Accumulator  Nitrogen  Charging  Cartridge  Valve:  (Valve  #11 1)  Leading  reported 
causes  of  failure  were  worn  valve  packing,  normal  valve  wear  and  aging,  and  worn  valve 
stem. 

2.  Scram  Discharge  Riser  Isolation  Valve:  Intergranular  Stress  Corrosion  Cracking  was 
blamed  for  the  failures  of  these  valves  as  the  valve  wedge  separated  from  the  stem. 

3.  Scram  water  accumulator:  The  chromium  plating  of  the  carbon  steel  tank  was  porous 
enough  to  allow  water  to  seep  into  the  carbon  steel  and  cause  corrosion,  resulting  in 
blistering  and  pitting  of  the  plating  throughout  the  cylinder.  These  loose  flakes  would 
leave  the  accumulator  and  collect  on  the  Teflon  seat  of  the  inlet  scram  valve,  causing 
some  leakage.  GE  and  Toshiba  developed  a  stainless  steel  replacement  for  this  unit. 

4.  Inlet  and  Outlet  Scram  Valves:  Primary  causes  of  degradation  were  aging  of  the  valve 
seat,  multiple  valve  parts  aging,  worn  valve  packing,  and  worn  valve  diaphragms. 

5.  Scram  Solenoid  Pilot  Valves:  The  causes  of  failure  most  frequently  observed  were 
worn  diaphragm,  aged  solenoid  components  (such  as  coil  “short”  or  blown  fuse),  and 
normal  valve  wear  or  aging.  Also  observed  was  degradation  of  the  valve  seats,  caused  by 
cracking  on  the  Buna-N  rubber  discs.  This  cracking  was  accelerated  by  long-term 
exposure  to  head  from  the  solenoid  coil  and  by  oil  and  water  contaminants  in  the 
instrument  air  supply.  The  symptoms  of  scram  pilot  valve  and  solenoid  degradation 
include  slow  scram  times,  leaking  air,  and  abnormal  solenoid  noise.  [17] 

3.7  Maintenance-Related  Failures 

From  a  review  of  2500  NPRDS  HCU  system  failure  reports,  it  was  found  that 
approximately  1 20  were  directly  attributed  to  previous  maintenance  or  human  error 
during  maintenance.  The  NPRDS  data  reviewed  spanned  from  1978-1996.  Major 
contributors  to  maintenance-related  failures  include  the  following: 
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1 .  Improper  installation  of  parts 

2.  Improper  adjustment  of  parts 

3.  Contamination  introduction  during  maintenance. 


3.8  Current  HCU  Maintenance  Practices 

The  maintenance  practices  of  the  United  States  and  Japan  are  starkly  different 
with  regard  to  the  HCUs.  Whereas  the  majority  of  US  plants  have  converted  to 
performing  HCU  maintenance  on-line,  the  Japanese  perform  their  HCU  maintenance  off¬ 
line,  during  annual  outages. 

3.8.1  Japanese  HCU  Maintenance  Practices 

As  mentioned  earlier,  the  Japanese  perform  all  preventive  and  corrective 
maintenance  on  the  HCUs  during  every  annual  outage.  Although  HCU  work  is  non- 
critical  path,  any  delay  in  HCU  work  will  adversely  affect  the  progress  of  CRDM  work, 
which  is  critical  path.  During  a  given  outage,  a  minimum  of  20  HCUs  are  maintained  by 
contractor  personnel.  The  maintenance  involves  complete  disassembly  of  components, 
replacement  of  parts,  METI  inspection,  reassembly,  leak  tests,  and  operational  tests. 
Table  3.1  is  a  listing  of  a  few  examples  of  HCU  preventive  maintenance  requirements 
and  their  periodicities.  [18] 


MAINTENANCE  ACTION 

PERIODICITY 

Replace  diaphragm  of  scram  valve  actuators 

5  years 

Clean  up  of  bodies,  bonnets,  stems  and  valve  seats  of  selector 
valves  followed  by  CRD  tuning  and  leak/functional  checks 

Clean  up  of  rupture  disks 

5  years 

Clean  up  accumulators  and  nitrogen  volumes 

7  years 

Clean  up  bodies,  bonnets,  stems,  valve  seats  of  scram  valves  and 

manually  operating  valves 

10  years 

Table  3.1 — Japanese  HCU  preventive  maintenance  requirements 
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3.8.2  US  HCU  Maintenance  Practices 


In  the  United  States,  most  nuclear  utilities  perform  HCU  maintenance  during 
normal  plant  operation.  For  plants  with  scheduled  outage  durations  of  approximately  20 
days,  on-line  HCU  maintenance  is  necessary  because  critical  path  items  require  the 
involvement  of  all  plant  personnel  [1],  leaving  little  or  no  resources  for  other  work.  By 
switching  to  on-line  maintenance,  including  that  of  HCUs,  US  plants  have  1)  managed  to 
shorten  plant  outage  durations,  2)  lowered  costs  associated  with  refueling  maintenance, 

3)  allowed  more  resources  to  be  devoted  to  critical  path  items  during  refueling,  and  4) 
employed  more  in-house  plant  personnel  in  the  performance  of  HCU  maintenance. 

Unlike  the  Japanese,  US  utilities  do  not  have  a  structured  and  standard  policy  for 
HCU  maintenance.  The  Japanese  have  industry-wide  preventive  maintenance 
requirements  for  HCUs  during  every  outage,  while  the  US  plants  each  differ  in  their 
approach.  What  is  performed  during  HCU  on-line  maintenance  is  decided  individually 
by  each  plant,  with  some  plants  emphasizing  preventive  maintenance  and  others  focusing 
on  corrective  maintenance.  In  other  words,  the  overwhelming  practice  in  the  US  is  to 
replace  HCU  components  as  they  fail  [1],  rather  than  having  a  strict  preventive 
maintenance  schedule  to  follow.  However,  for  components  that  are  prone  to  failure, 
some  utilities  have  adopted  preventive  maintenance  requirements.  Examples  of  these 
components  include  the  scram  solenoid  pilot  valves  (most  utilities  change  out 
components  every  1 5  years)  and  scram  valves  diaphragms  (changed  out  every  1 5  years  at 
most  plants).  [1] 

On-line  HCU  maintenance  was  accepted  in  the  US  because  it  was  viewed  as  a 
practice  where  the  benefits  would  be  great  while  the  risks  were  low.  The  main  goal  was 
to  reduce  the  cost  of  work  performed  during  outages,  and  on-line  HCU  maintenance 
achieved  this  by  reducing  the  outage  duration  and  breaking  the  utilities’  reliance  on 
contractor  personnel  to  perform  maintenance.  The  arguments  that  convinced  utility 
executives  that  on-line  HCU  maintenance  would  be  safe  and  beneficial  were  the 
following:  [3] 
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1 .  All  General  Electric  BWR  HCUs  are  designed  to  be  individually  isolable,  allowing 
maintenance  to  be  performed  in  a  safe  condition,  thereby  easing  the  concern  for 
maintaining  industrial  safety. 

2.  Off-line  HCU  maintenance  was  costly  because  contractor  personnel  were  relied  upon 
to  perform  the  maintenance.  On-line  maintenance  allows  trained  in-house  personnel  to 
perform  HCU  maintenance  during  normal  power  operation. 

3.  The  effect  upon  the  plant  and  the  cost  of  replacement  power  could  be  reduced  by 
coordinating  necessary  electric  load  drops  with  low  power  demand  periods. 

As  for  the  NRC,  on-line  maintenance  was  judged  to  be  acceptable  if  the  utilities 
remained  within  their  respective  Technical  Specifications  [1],  The  Technical 
Specifications  for  control  rod  operability  are  given  in  Table  3.2.  The  US  utilities  are  able 
to  perform  HCU  maintenance  on-line  because  the  technical  specifications  allow  one  or 
more  control  rods  to  be  inoperable  if  1)  the  rod  is  fully  inserted  within  3  hours  and  2) 
disarmed  within  four  hours  (see  Condition  C  in  Table  3.2). 
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3.1  REACTIVITY  CONTROL  SYSTEMS 
3.1 .3  Control  Rod  OPERABILITY 

LCO  3.1.3  Each  control  rod  shall  be  OPERABLE. 


APPLICABILITY:  MODES  1  and  2. 


ACTIONS 

-  NOTE  - 

Separate  Condition  entry  is  allowed  for  each  control  rod. 


CONDITION 

REQUIRED  ACTION 

COMPLETION  TIME 

A.  One  withdrawn  control 
rod  stuck. 

-  NOTE  - 

Rod  worth  minimizer 
(RWM)  may  be  bypassed 
as  allowed  by 

LCO  3.3.2. 1,  "Control  Rod 
Block  Instrumentation,"  if 
required,  to  allow 
continued  operation. 

A.1 

Verify  stuck  control  rod 
separation  criteria  are  met. 

Immediately 

AND 

A. 2 

Disarm  the  associated 
control  rod  drive  (CRD). 

2  hours 

AND 

Table  3.2  Control  Rod  Operability  Technical  Specifications  [19] 
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CONDITION 

REQUIRED  ACTION 

COMPLETION  TIME 

A. 3  Perform  SR  3.1 .3.2  and 

SR  3. 1.3.3  for  each 
withdrawn  OPERABLE 
control  rod. 

AND 

24  hours  from 
discovery  of  Condition 

A  concurrent  with 
THERMAL  POWER 
greater  than  the  low 
power  setpoint  (LPSP) 
of  the  RWM 

A.4  Perform  SR  3.1.1 .1 . 

72  hours 

B.  Two  or  more  withdrawn 
control  rods  stuck. 

B.1  Be  in  MODE  3. 

12  hours 

C.  One  or  more  control 
rods  inoperable  for 
reasons  other  than 
Condition  A  or  B. 

C.1  - - - 

-  NOTE  - 

RWM  may  be  bypassed  as 
allowed  by  LCO  3.3.2. 1 ,  if 
required,  to  allow  insertion 
of  inoperable  control  rod 
and  continued  operation. 

Fully  insert  inoperable 
control  rod. 

AND 

3  hours 

C.2  Disarm  the  associated 

CRD. 

4  hours 

Table  3.2  Control  Rod  Operability  Technical  Specifications  [19] 
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CONDITION 

REQUIRED  ACTION 

COMPLETION  TIME 

D.  - 

-  NOTE  - 

Not  applicable  when 
THERMAL  POWER 
>  [10]%  RTP. 

D.1  Restore  compliance  with 

BPWS. 

OR 

4  hours 

Two  or  more  inoperable 
control  rods  not  in 
compliance  with  banked 
position  withdrawal 
sequence  (BPWS)  and 
not  separated  by  two  or 
more  OPERABLE 
control  rods. 

D.2  Restore  control  rod  to 

OPERABLE  status. 

4  hours 

E.  - — 

-  NOTE  - 

[  Not  applicable  when 
THERMAL  POWER 
>  [10]%  RTP. 

One  or  more  groups  with 
four  or  more  inoperable 
control  rods. 

E.1  Restore  control  rod  to 

OPERABLE  status. 

4  hours  ] 

F.  Required  Action  and 
associated  Completion 
Time  of  Condition  A,  C, 

D,  or  E  not  met. 

OR 

Nine  or  more  control 
rods  inoperable. 

F.1  Be  in  MODE  3. 

12  hours 

Table  3.2  Control  Rod  Operability  Technical  Specifications  [19] 
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Fault  Tree  Analysis 


4.1  Introduction 


In  order  to  analyze  complex  systems  and  their  modes  of  failure  of  components 
and  actions,  it  is  necessary  to  construct  fault  trees.  A  fault  tree  shows  the  logic 
connecting  individual  failures  (basic  events)  to  system  failures  (top  events),  and  it  also 
allows  the  calculation  of  system  failure  probability  (top  event  probability)  using  Boolean 
algebra.  In  this  study,  the  fault  tree  was  utilized  to  calculate  the  probabilities  for  the 
following  top  events  in  the  HCU  system: 


Top  Event  1 : 
Top  Event  2: 
Top  Event  3: 
Top  Event  4: 
Top  Event  5: 
Top  Event  6: 


Excessive  Scram  Time 

Failure  to  Scram 

Inadvertent  Rod  Motion  Inward 

Inadvertent  Rod  Motion  Outward 

Failure  to  Move  Control  Rod  Inward 

Failure  to  Move  Control  Rod  Outward. 


4.2  Definition  of  Top  Events 


The  top  events  are  as  follows: 

1.  Excessive  Scram  Time:  Time  to  scram  rod  exceeds  time  specified  in  technical 
specifications. 

2.  Failure  to  Scram:  Control  rod  fails  to  insert  when  scram  signal  is  received. 

3.  Inadvertent  Rod  Motion  Inward:  Control  rod  moves  inward  without  application  of 
scram  signal  or  inward  motion  signal  from  reactor  instrumentation  and  control. 

4.  Inadvertent  Rod  Motion  Outward:  Control  rod  moves  outward  without  application  of 
outward  motion  signal  from  reactor  instrumentation  and  control 

5.  Failure  to  Move  Control  Rod  Inward/Outward:  Failure  to  control  rod  to  respond  to 
inward/outward  signal  from  reactor  instrumentation  and  control. 
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4.3  Symbols  of  Fault  Tree  Analysis 

Figure  4.1  summarizes  the  conventional  fault  tree  symbols. 


•  Event  A  occurs  when  •  Event  A  occurs  when 
either  event  B  or  C  both  event  B  and  C 

occurs  occur 


Figure  4.1  Conventional  Fault  Tree  Symbols 
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4.4  Example  of  Fault  Tree  Analysis 


To  illustrate  how  a  simple  fault  tree  analysis  is  structured,  the  internal  combustion 
engine  shown  in  Figure  4.2  is  considered.  Figure  4.3  is  the  fault  tree  constructed  that 
diagrams  how  the  top  event  “Low  cylinder  compression”  (LCC)  may  occur.  Using  the 
“+”  for  the  “OR”  operation  and  “X”  for  the  “AND”  operation,  the  following  Boolean 
equation  is  acquired  for  the  top  event: 

LCC  =  HG  +  IV  +  SP  +  (PR1  *  PR2) 


Spark 

plug 


Figure  4.2  Internal  Combustion  Engine  [20] 
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Figure  4.3  Fault  Tree  for  Low  Cylinder  Compression  ;  LCC  =  HG  +  IV  +  SP  + 

(PR1  *  PR2)  [20] 


4.5  Determination  of  Basic  Event  Probabilities 


In  the  determination  of  the  values  of  the  top  event  probabilities  for  the  HCU, 
basic  event  data  were  acquired  primarily  from  the  INPO  database  of  NPRDS  failure 
reports.  The  database  spanned  the  interval  from  1978-1996  and  contained  approximately 
3500  failure  reports  of  the  HCUs  of  US  utilities.  For  this  study,  we  analyzed  data  from 
four  nuclear  power  plants:  Brunswick  1,  Peach  Bottom  3,  Quad  Cities  1,  and 
Susquehanna  1 . 

The  determination  of  basic  event  frequencies  was  performed  by  utilizing  the 
following  equation: 

Basic  event  frequency  =  Number  of  basic  event  occurrences 

(Number  of  components  available)  *  (Report  Interval). 
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Unfortunately,  not  all  of  the  basic  events  in  the  fault  trees  were  accounted  for  in  the 
NPRDS  database,  requiring  educated  guesses  to  be  made  about  their  probability  values. 
This  was  done  by  selecting  similar  basic  events  for  which  data  were  available  and 
assigning  their  frequencies  of  occurrence  to  the  basic  events  for  which  data  were  not 
available.  For  example,  there  were  no  explicit  data  available  for  the  basic  event  “SSPV 
failure  to  vent  due  to  improper  substances  used  during  maintenance”,  but  there  were  data 
available  for  the  basic  event  “SSPV  failure  to  vent  due  to  debris  intrusion.”  The  number 
of  occurrences  for  the  latter  event  was  also  assumed  to  obtain  the  former,  resulting  in  a 
guess  at  the  “SSPV  failure  to  vent  due  to  improper  substances  used  during  maintenance” 
basic  event  probability. 

Finally,  for  those  events  where  data  were  not  available  and  there  existed  similar  events 
for  which  actual  occurrences  had  been  observed,  we  assigned  one  occurrence  during  the 
report  period.  Appendix  A  contains  fault  trees  for  Top  Events  1  through  5  and  all  basic 
event  probability  and  top  event  probability  data. 

4.6  Treatment  of  Human  Error 

When  data  are  not  available  for  basic  events  which  are  directly  attributable  to 
human  error,  we  must  estimate  the  values  of  their  respective  Human  Error  Probabilities 
(HEP).  In  this  study,  we  utilized  the  Technique  for  Human  Error  Rate  Prediction 
(THERP)  to  estimate  the  HEP  values  related  to  the  following  basic  events: 

•  Failure  to  restore  valves  to  required  positions  concerning  valves:  V-101,  102, 

103,  105,  107,112 

•  Failure  to  restore  charging  water  flow  path 

•  Failure  to  restore  valve  V-l  1 5  in  the  charging  water  system 

•  Failure  to  restore  valve  V- 1 1 3  in  the  charging  water  system. 

The  THERP  method  provides  error  probability  values  for  generic  tasks  and  also 
describes  the  process  used  to  modify  these  rates  depending  on  specific  performance 
shaping  factors  (PSFs)  involved  in  the  task  being  analyzed  [20].  Performance  shaping 


45 


factors  are  multiplicative  factors  that  are  applied  to  modify  the  nominal  human  error 
probability  value  in  order  to  reflect  the  actual  performance  situation.  For  example,  if  the 
labeling  scheme  at  a  particular  plant  is  poor,  the  human  error  probability  value  will 
increase.  Conversely,  if  maintenance  procedures  are  particularly  good,  the  probability  of 
some  errors  can  be  decreased  by  applying  a  PSF  that  modifies  the  human  error 
probability  from  its  nominal  value  based  upon  the  adequacy  of  the  procedures  being  used. 

This  method  requires  the  performance  of  four  steps  [21].  The  first  step  involves 
defining  the  task,  determining  what  constitutes  failure,  and  what  human  actions  can  lead 
to  this  failure.  In  this  study,  the  task  of  interest  is  failure  to  restore  specific  valves  in  the 
HCU  system  to  their  proper  alignments.  Figure  4.4  shows  a  tree  diagram  that  can  be 
constructed  in  order  to  represent  possible  sequences  of  successes  and  failures  in 
performing  different  subtasks.  Events  A,  B,  and  C  are  the  first,  second,  and  third  tasks 
that  are  performed.  The  solid  lines  and  lower  case  letters  represent  success  and  the 
broken  lines  and  capital  letters  represent  failure. 


Figure  4.4  Example  of  THERP  Tree  Event  Combination  Diagramming  for  Events 

A,  B,  and  C.  [20] 

The  next  step  requires  the  determination  of  basic  error  rates  relevant  to  the  tree  in  Figure 
4.4.  The  estimated  error  rates  are  obtained  from  Swain,  et  al.  (1980).  Because  these 
basic  human  error  rates  are  obtained  from  performance  under  average  industry 
conditions,  the  third  step  incorporates  the  effects  of  PSFs  to  account  for  stress,  work 
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environment  factors,  etc.  The  final  step  involves  summing  the  individual  sequence 
probabilities  for  the  failure  sequences  in  the  THERP  tree  in  order  to  obtain  the  value  of 
the  probability  of  failure  for  the  task. 

For  this  study,  we  utilize  the  HEP  concept  concerning  the  event,  failure  to  restore 
HCU  system  valve  configuration,  as  calculated  from  Credit,  et.  al  (1992).  The  HEP 
accounts  for  five  factors  that  affect  the  likelihood  of  human  error  during  maintenance: 

•  whether  relevant  procedures  are  available  and  used 

•  quality  of  the  procedures 

•  whether  maintenance  technicians  are  trained  on  the  specific  task 

•  whether  a  person  from  the  Quality  Control  department  performs  a  second 
check  on  the  maintenance  work 

•  whether  post-maintenance  testing  is  done. 

Figure  4.5  shows  the  possible  combinations  of  the  above  factors  and  the  HEPs  associated 
with  each  combination.  The  human  error  probabilities  (HEP)  and  error  factors  (EF)  are 
obtained  from  Tables  4.1-4.3  (adopted  from  Swain,  et  al.  (1980)). 

“The  human  error  rates  obtained  through  use  of  Figure  4.5  are  determined  by 
multiplying  a  basic  human  error  probability  by  reduction  factors  that  account  for  the  five 
factors  above.  For  example,  Table  4.2  is  used  to  quantify  the  human  error  rate  when  the 
operators  use  procedures  that  are  above  average  quality.  The  value  for  this  parameter  is 
0.0021.  The  reduction  factors  for  the  other  branches  are  quantified  using  Table  4.3.  For 
example.  Table  4.3  presents  human  error  rates  for  failing  to  detect  errors  made  by  others. 
For  checking  routine  tasks  using  written  materials,  a  human  error  rate  of  0.1  is  given.  For 
checks  that  involve  active  participation,  e.g.,  post  maintenance  testing,  an  error  rate  of 
0.01  is  given.”  [21]  Table  4.4  presents  the  human  error  probabilities  (HEP)  and  error 
factors  (EF)  used  in  estimating  the  human  error  rates  underlying  Figure  4.5.  In  this  study, 


1  This  value  is  derived  using  entries  from  Table  6.2.  This  Table  gives  a  human  error  probability  value  of 
0.001  for  an  error  of  omission  when  using  procedures  that  consist  of  short  lists  and  check-off  provisions.  It 
is  assumed  that  this  is  an  optimal  form  for  the  procedure.  It  is  further  assumed  that  an  error  of  commission 
is  always  possible  and  that  the  human  error  probability  value  in  this  case  is  also  0.001.  Therefore,  the  total 
error  rate  is  0.001+0.001=0.002.  [21] 
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we  utilized  the  HEP  of  2x1 0‘6  to  reflect  use  of  quality  procedures,  adequate  training  on 
the  task,  second-check,  and  post-maintenance  testing. 


Estimated  HEPs  related  to  failure  of 
administrative  control 


I  tern 

Task 

HEP 

EF 

(D 

Carry  out  a  plant  policy  or  scheduled  tasks 
such  as  periodic  tests  or  maintenance  per¬ 
formed  weekly,  monthly,  or  at  longer  intervals 

.01 

5 

(2) 

Initiate  a  scheduled  shiftly  checking  or 
inspection  function* 

Use  written  operations  procedures  under 

.C01 

3 

(3) 

normal  operating  conditions 

.01 

3 

(4) 

abnormal  operating  conditions 

in 

o 

o 

10 

(5) 

Use  a  valve  change  or  restoration  list 

.01 

3 

(6) 

Use  written  test  or  calibration  procedures 

.05 

5 

(7) 

Use  written  maintenance  procedures 

.3 

5 

(8) 

Use  a  checklist  properly** 

.5 

5 

Assumptions  for  the  periodicity  and  type  of  control  room  scans  are 
discussed  in  Chapter  11  in  the  section,  "A  General  Display  Scanning 
Model.1'  Assumptions  for  the  periodicity  of  the  basic  walk-arcund 
inspection  are  discussed  in  Chapter  19  in  the  section,  "Basic  Walk- 
Around  Inspection." 

** 

Read  a  single  item,  perform  the  task,  check  off  the  item  on  the 
list.  For  any  item  in  which  a  display  reading  or  other  entry  must 
be  written,  assume  correct  use  of  the  checklist  for  that  item. 


Table  4.1 — Estimated  HEPs  Related  to  Failure  of  Administrative  Control  [22] 
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Estimated  probabilities  of  errors  of  omission  per  item  of 
instruction  when  use  of  written  procedures  is  specified1* 


Item** 


Omission  of  item: 


HEP  E? 


When  procedures  with  checkoff^ 
provisions  are  correctly  used  : 

(1)  Short  list,  <10  items  ,001  3 

(2)  hong  list,  >10  items  ,003  3 


When  procedures  without  checkoff  provisions  are  ^ 

used,  or  when  checkoff  provisions  are  incorrectly  used  : 


(3)  Short  list,  <10  items 


*003  3 


(4)  Long  list,  >10  items  .01  3 

(5)  When  written  procedures  are  avail-  ^  .05  5 

able  and  should  be  used  but  are  not  used 


The  estimates  for  each  item  (or  perceptual  unit)  presume  zero  dependence 
among  the  items  (or  units)  and  must  be  modified  by  using  the  dependence 
model  when  a  nonzero  level  of  dependence  is  assumed. 

■*  + 

The  term  "item"  for  this  column  is  the  usual  designator  for  tabled 
entries  and  does  not  refer  to  an  item  of  instruction  in  a  procedure. 

^Correct  use  of  checkoff  provisions  is  assumed  for  items  in  which  written 
entries  such  as  numerical  values  are  required  of  the  user. 

**Table  16-1  lists  the  estimated  probabilities  of  incorrect  use  of  checkoff 
provisions  and  of  nonuse  of  available  written  procedures. 

4* 

If  the  task  is  judged  to  be  "second  nature,"  use  the  lower  uncertainty 
bound  for  .05,  i.e. ,  use  .01  (EF  *  5). 


Table  4.2 — Estimated  Probabilities  of  Errors  of  Omission  per  Item  of  Instruction 
When  Use  of  Written  Procedures  is  Specified  [22} 
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Estimated  probabilities  that  a  checker  will  fail  to 
detect  errors  made  by  others* 


Item 


Checking  Operation 


HEP  EF 


(1)  Checking  routine  tasks,  checker  using  written  .1  5 

materials  (includes  over- the-shoulder  inspections, 

verifying  position  of  locally  operated  valves, 
switches,  circuit  breakers,  connectors,  etc.,  and 
checking  written  lists,  tags,  or  procedures  for 
accuracy ) 

(2)  Same  as  above,  but  without  written  materials  ,2  5 

(3)  Special  short-term,  one-of-a-kind  checking  with  .05  5 

alerting  factors 

(4)  Checking  that  involves  active  participation,  such  as  .01  5 

special  measurements 


Given  that  the  position  of  a  locally  operated  valve 
is  checked  (item  1  above),  noticing  that  it  is  not 
completely  opened  or  closed: 

(5)  Position  indicator**  only 

(6)  Position  Indicator**  and  a  rising  stem 

(7)  Neither  a  position  indicator**  nor  a  rising  stem 

(8)  Checking  by  reader/checker  of  the  task  performer  in 
a  two-man  team,  or  checking  by  a  second  checker, 
routine  task  (no  credit  for  more  than  2  checkers) 

(9)  Checking  the  status  of  equipment  if  that  status 
affects  one’s  safety  when  performing  his  tasks 

(10)  An  operator  checks  change  or  restoration  tasks 
performed  by  a  maintainer 


.5  5 

.  1  5 

.5  5 

.  9  5 

.5  5 

.001  5 

Above  5 

HEPs 
+  2 


This  table  applies  to  cases  during  normal  operating  conditions  in  which  a 
person  is  directed  to  check  the  work  performed  by  others  either  as  the 
work  is  being  performed  or  after  its  completion. 

A  position  indicator  incorporates  a  scale  that  indicates  the  position  of 
the  valve  relative  to  a  fully  opened  or  fully  closed  position.  A  rising 
stem  qualifies  as  a  position  indicator  if  there  is  a  scale  associated 
with  it. 


Table  4.3 — Estimated  Probabilities  That  a  Checker  Will  Fail  to  Detect  Errors  Made 

by  Others  [22] 
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Decision  Analysis  and  Multi-Attribute  Utility  Theory 


5.1  Introduction 

Like  most  electric  utility  companies  entering  economic  deregulation,  the 
objectives  of  TEPCO  concerning  this  maintenance  study  are  as  follows:  [23] 

1 .  To  shorten  the  duration  of  outages 

2.  To  assure  that  maintenance  takes  place  year-round,  employing  workers  from  the  local 
community  year-round,  thus  improving  relations  with  the  local  government  and  public 

3.  To  enhance  the  competitiveness  and  safety  of  the  nuclear  power  plants  of  TEPCO 
from  the  perspective  of  cost,  using  risk  information. 

In  order  to  achieve  these  objectives,  decisions  must  be  made  in  a  balanced  and  systematic 
way,  using  risk  information,  traditional  safety  approaches  (i.e.  defense  in  depth),  and 
taking  into  account  factors  such  as  economics,  stakeholder  relations,  and  safety. 

Decision  analysis  is  a  means  by  which  decision  options  can  be  formulated  and 
ranked  in  a  structured  manner  by  “1)  enumerating  the  choices  available  to  the  decision 
maker,  2)  characterizing  relative  uncertainties,  3)  quantifying  the  relative  desirability  of 
outcomes,  and  4)  providing  rules  for  ranking  the  decision  options,  thus  helping  the 
decision  maker  to  select  the  “best”  option.”  [23] 

5.2  Multi-Attribute  Utility  Theory  (MAUT) 

In  order  to  make  the  right  decision  that  will  satisfy  many  objectives,  MAUT  is 
utilized  as  the  means  by  which  decision  options  are  analyzed  and  ranked  according  to 
favorability.  In  MAUT,  the  measure  of  favorability  is  called  the  “Performance  Index,” 
(also  known  as  the  “expected  utility”  of  the  decision  option)  and  it  is  calculated  for  each 
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decision  option  considered.  A  PI  is  the  sum  of  the  weights  of  performance  measures 
(PM),  which  are  determined  through  an  analytical  process  (known  formally  as  Analytical 
Hierarchy  Process  (AHP)),  multiplied  by  the  utility  of  each  PM  with  respect  to  each 
option.  We  use  this  method  to  analyze  the  decision  options  available  to  HCU 
maintenance  at  TEPCO.  Equation  5.1  [4]  summarizes  the  integration  of  decision  factors 
and  Figure  5.1  shows  their  hierarchy,  where 


Plj  =  performance  index  for  the  j*  decision  option 
Wj  =  weight  of  thei*  PM 

utJ  =  the  utility  for  the  i*  PM  given  by  the  j*  decision  option 


Equation  5.1 


5.2.1.  Value  Tree 


The  Value  Tree  shown  in  Figure  5.1  is  a  hierarchical  structure  of  objectives  to  be 
achieved  via  the  available  decision  options.  The  overall  objective,  “Safe,  Reliable,  and 
Efficient  Power  Production,”  is  located  in  Tier  1  of  the  tree.  The  tiers  below  decompose 
the  higher  level  objectives  concerning  how  the  decision  maker  plans  to  achieve  the 
overall  objective.  For  example,  to  achieve  “Safe,  Reliable,  and  Efficient  Power 
Production,”  one  must  consider  safety,  cost,  and  stakeholder  relations  (Tier  2).  Safety, 
cost,  and  stakeholder  relations  can  be  further  broken  down  to  public  safety,  worker 
safety,  income,  government,  etc.  Tier  4  represents  concrete  goals  that  the  decision  maker 
wants  to  achieve  in  terms  of  the  factors  considered,  and  Tier  5  provides  a  means  for 
quantifying  the  achievement  of  each  goal  above.  The  attributes  in  Tier  5  are  termed 
Performance  Measures  (PM),  and  Table  5.1  provides  a  definition  of  each  Performance 
Measure. 


Table  5.1;  Definitions  of  Performance  Measures  Used  in  TEPCO  Project  [24] 


Name  of  PM 

Definition 

Public  Dose 

Cumulative  dose  among  the  public,  which  would  be  exclusively 
derived  from  a  massive  release  of  radioactive  materials  due  to  an 
accident  (does  not  include  any  worker  casualties). 

Work  Loss  Days 

Lost  work-days  calculated  by  the  definition  in  "Labor  Standard 
Act",  which  includes  contribution  of  both  work  resulting  from  a 
release  of  radioactive  materials  and  from  an  industrial  accident 

Plant  Unavailability 

Expected  power  loss  due  to  reactor  shutdown  and/or  power 
suppression,  converted  into  loss  of  days  at  full  power  generation 
using  the  following  equation: 

PU  =  (Missed  electricity  production)  /  {(Plant  Electric  Rated 
Power)  *  24  hrs} 

Expenses 

Cost  of  maintenance  and  operation,  namely  maintenance, 
personnel,  supplies  and  fuel  costs  as  well  as  depreciation  and 
related  taxes,  and  expected  cost  in  case  of  undesirable 
occurrences  (ex.  unplanned  shutdown)  resulting  from  the 
decision  being  made. 

Relation  w/  METI 

Influences  upon  relationship  between  TEPCO  and  METI  by  the 
decision  being  made.  (Very  Good,  Good,  Weak,  Bad,  Very  Bad) 

Relation  w/  Local 
Government 

Effect  upon  mood  between  TEPCO  and  local  govemment(s)  with 
respect  to  matters  other  than  “stable  employment”  and  “public 
acceptance”  by  the  decision  being  made.  (V ery  good,  Good, 

Weak,  Bad,  Very  Bad) 
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Work  Load 

Expected  number  of  workers  to  be  shifted  to  online  in  the  next 
four  operational  cycles  suggested  by  the  decision  being  made 
(Number  of  workers) 

Media  Coverage 

Expected  media  reaction  on  the  decision  being  made  (Very  Good, 
Good,  Weak,  Bad,  Very  Bad) 

5.2.2  Analytical  Hierarchy  Process  (AHP) 

The  Analytical  Hierarchy  Process  (AHP)  allows  the  decision  maker  to  assign  a 
weight  to  each  performance  measure,  enabling  the  decision  maker  to  prioritize  and  rank 
each  PM.  Pairwise  comparisons  are  utilized  in  the  AHP  in  order  to  determine  the  weight 
of  each  item  as  the  decision  maker  compares  two  items  at  a  time  and  determines  which  is 
more  important  with  respect  to  the  other.  The  scale  he  uses  is  shown  in  Table  5.2.  For 
example,  objectives  on  each  tier  of  the  value  tree  are  compared  and  rated  with  respect  to 
other  objectives  in  the  same  tier.  This  process  is  iterated  until  Tier  5  is  reached  where  the 
PMs  are  weighted  against  each  other.  The  weights  are  finally  calculated  using  computer 
software  such  as  “Expert  Choice.”  The  weights  determined  for  each  PM  are  shown  in 
Figure  5.1  in  Tier  5  below  each  PM.  These  weights  apply  for  the  example  assuming  that 
the  decision  makers  place  50%  of  importance  to  Safety,  25%  to  Economics,  and  25%  to 
Stakeholder  Relations. 


Intensity 

Definition 

Explanation 

1 

Equal  importance 

Two  activities  contribute  equally  to  the  objective. 

3 

Weak  importance  of  one 
over  another 

Experience  and  judgment  slightly  favor  one 
activity  over  another. 

5 

Essential  or  strong 
importance 

Experience  and  judgment  strongly  favor  one 
activity  over  another 

7 

Very  strong  or 
demonstrated  importance 

An  activity  is  favored  very  strongly  over  another; 
its  dominance  demonstrated  in  practice. 

9 

Absolute  importance 

The  evidence  favoring  one  activity  over  another 
is  of  the  highest  possible  order  of  affirmation. 

2,4,6, 8 

Intermediate  values 
between  adjacent  scale 
values 

Used  when  compromise  is  needed. 

Table  5.2:  Comparison  scale  to  Determine  Weight  of  Performance  Measures  [24] 
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5.2.3  Constructed  Scales  and  Utility  Functions 


For  PMs  that  are  quantifiable,  the  decision  maker  will  set  a  range  for  each  PM 
that  is  practical  and  carefully  considers  the  consequences  of  the  decision  to  be  made. 

This  range  is  divided  into  several  levels  (designated  by  a  scale  number),  and  a  pairwise 
comparison  is  made  between  the  levels  to  determine  individual  weights.  The  weights  are 
then  converted  into  utility  values  that  range  from  0  to  1  using  the  following  equations: 

u  =  a  +  b  *  w,  where 
a  =  -b  *  (smallest  weight),  and 
b  =  1/  { (biggest  weight)  -  (smallest  weight) }. 

Generally  the  term  u  represents  the  utility,  but  in  this  project,  we  wish  to  express  the 
decision  maker’s  degree  of  dislike  for  a  consequence  in  terms  of  the  PMs,  therefore  u 
actually  represents  the  “disutility”  of  the  decision. 

For  PMs  that  are  not  objectively  quantifiable  such  as  “Relation  with  METI,”  the 
decision  maker  constructs  scales  that  quantitatively  represent  each  state  of  the  PM  and 
then  a  disutility  is  assessed  for  each  scale  value.  In  summary,  a  high  disutility  correlates 
with  low  desirability  (i.e.  a  disutility  of  unity  equates  to  the  least  desirable  consequence). 
[24] 

5.3  Application  to  HCU  Maintenance  Options 

In  this  study,  MAUT  is  utilized  to  provide  a  ranking  of  the  desirability  of  the 
following  decision  options  for  HCU  maintenance: 

1 .  On-line  HCU  maintenance  with  no  change  in  outage  duration 

2.  Off-line  HCU  maintenance  with  no  change  in  outage  duration 

3.  On-line  HCU  maintenance  with  a  shortened  outage 

4.  Off-line  HCU  maintenance  with  a  shortened  outage. 
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In  reference  to  the  value  tree,  these  “Decision  Options”  are  considered,  and  a 
“Utility  Analysis”  is  performed  in  order  to  determine  the  impact  of  a  specific  Decision 
Option  upon  each  Performance  Measure.  The  “Utility  Analysis”  involves  the  evaluation 
of  the  values  of  utilities  using  methods  of  Probabilistic  Risk  Assessment  (PRA)  and 
expert  judgment.  In  this  study,  we  chose  to  use  fault  trees  to  determine  the  values  of  the 
top  event  probabilities  for  six  different  HCU  system  failures: 


Top  Event  1 : 
Top  Event  2: 
Top  Event  3: 
Top  Event  4: 
Top  Event  5: 
Top  Event  6: 


Excessive  Scram  Time 

Failure  to  Scram 

Inadvertent  Rod  Motion  Inward 

Inadvertent  Rod  Motion  Outward 

Failure  to  Move  Control  Rod  Inward 

Failure  to  Move  Control  Rod  Outward. 


For  each  decision  option,  the  effect  of  occurrence  of  the  respective  six  top  events 
on  each  of  the  performance  measures  was  considered,  values  of  the  disutilities 
formulated,  and  expected  disutility  values  calculated  based  upon  knowledge  of  the  top 
event  probabilities.  Alternately,  the  effect  of  no  top  event  occurring  upon  each 
performance  measure  was  also  considered.  These  expected  disutility  values  are  then 
multiplied  by  the  weight  of  each  PM  and  summed  in  order  to  obtain  the  values  of  the 
overall  performance  index  value  for  the  decision  option  under  consideration.  The  option 
having  the  lowest  overall  performance  index  value  is  the  most  desirable.  The  next 
section  describes  in  detail  the  use  of  MAUT  to  quantify  the  effects  of  the  HCU 
maintenance  options  considered  on  the  Performance  Measures. 
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Quantitative  Impact  of  HCU  Maintenance  Options 
Upon  Performance  Measure  Values 

6.1  Introduction 

In  an  effort  to  boost  competitiveness  in  a  deregulated  electricity  market,  US 
nuclear  power  plant  utilities  were  forced  to  change  how  their  plants  are  maintained  and 
operated.  One  change  that  has  produced  tangible  benefits  was  the  shift  of  HCU 
maintenance  from  being  performed  off-line  (during  outages)  to  being  performed  on-line. 
This  change  shortened  outage  durations,  reduced  outage  maintenance  costs,  and  allowed 
plant  personnel  to  be  utilized  year-round  for  the  performance  of  on-line  HCU 
maintenance.  Although  no  formal  risk  analysis  was  performed  by  the  US  in  order  to 
justify  the  shift,  the  benefits  realized  greatly  outweighed  the  risks  involved.  This  study 
provides  a  quantitative  measure  of  the  desirability  of  on-line  maintenance  from  the 
perspective  of  TEPCO,  and  it  also  serves  as  a  model  for  formal  analysis  of  various 
decision  options. 

This  section  demonstrates  how  MAUT  can  be  utilized  to  provide  a  rank-ordering 
of  the  attractiveness  of  the  decision  options  available  in  this  study.  The  decision  options 
available  to  decision  makers  at  TEPCO  are  the  following: 

1 .  On-line  HCU  maintenance  with  no  change  in  outage  duration 

2.  Off-line  HCU  maintenance  with  no  change  in  outage  duration 

3.  On-line  HCU  maintenance  with  a  shortened  outage 

4.  Off-line  HCU  maintenance  with  a  shortened  outage. 

The  use  of  MAUT  allows  decision  makers  to  consider  not  only  the  effects  upon  safety 
and  economics  but  also  the  effects  on  stakeholder  relations.  This  analysis  can  be  used  as 
an  aid  to  1)  enhance  consensus  building,  2)  provide  a  systematic  method  for  processing  a 
large  amount  of  information,  3)  provide  formal  rules  for  quantifying  preferences,  and  4) 
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enhance  the  decision-making  process  by  improving  communication  between  decision 
makers.  [23] 

6.2  Overview  of  Quantitative  Analysis  Approach 

Figure  6.1  is  a  flowchart  illustrating  the  quantitative  analysis  approach  taken  in 
the  use  of  MAUT  to  rank  the  desirability  of  various  HCU  maintenance  options.  The  first 
step  in  the  formal  analysis  is  to  list  the  decision  options  available.  In  reference  to  the 
value  tree,  results  of  this  evaluation  appear  at  the  very  bottom  tier.  In  this  case  study,  the 
options  available  are  different  combinations  of  on-line  or  off-line  HCU  maintenance 
under  the  conditions  of  a  long  or  short  outage.  The  long  outage  cases  assume  that 
TEPCO  maintains  its  current  outage  duration  (90  days  on  average).  The  short  outage 
cases  assume  that  TEPCO  becomes  more  efficient  in  the  accomplishment  of  critical  path 
items  and  shifts  some  non-critical  path  maintenance  items  to  being  performed  on-line. 

The  next  step  considers  each  decision  option  and  its  effect  on  the  values  of  the 
performance  measures  of  the  value  tree.  On  the  value  tree,  this  is  the  “Utility  Analysis” 
under  Tier  5.  This  step  is  actually  the  most  complex  in  that  several  calculations  must  be 
performed  prior  to  calculating  the  overall  performance  index.  These  calculations  include 
the  determination  of  the  values  of  the  basic  event  and  top  event  probabilities  from 
NPRDS  data,  of  human  error  probabilities,  and  of  expected  disutility  values.  Because 
there  were  no  objective  information  available  regarding  the  consequences  of  the 
occurrence  or  non-occurrence  of  an  HCU  top-event,  the  majority  of  our  results  are  based 
upon  the  expert  judgment  of  TEPCO  engineers.  The  overall  performance  index  values 
are  calculated  using  the  expected  disutility  values  and  performance  measure  weights. 

The  decision  option  having  the  lowest  overall  PI  value  is  the  most  desirable. 

The  last  step  considers  changes  in  the  weights  of  the  performance  measures  to 
reflect  differences  in  the  preferences  of  the  decision  makers. 
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Consider 

Decision 

Options 


-Long-On:  On-line  HCU 
maintenance  with  a  LONG 
OUTAGE 

-Long-Off:  Off-line  HCU 
maintenance  with  LONG 
OUTAGE' 

-Short-On:  On-line  HCU 
maintenance  with  SHORT 
OUTAGE 

-Short-Off:  On-line  HCU 
maintenance  with  SHORT 
OUTAGE 


Calculate  Top 
Event 

Probabilities 


-Construct  Fault  Trees  for 
Important  HCU  failures: 

•Excessive  Scram  Time 

•Failure  to  Scram 

•Inadvertent  Rod  Motion  Inward 

•Inadvertent  Rod  Motion 
Outward 

•Failure  to  Move  Rod  In 

•Failure  to  Move  Rod  Out 

-Calculate  basic  event  probability 
values  and  top  event  probability 
values  from  available  data 


Perform 

Utility 

Analysis  and 
Calculate 
Overall 
Performance 
Index 


-Evaluate  effects  of  Top  Events 
upon  Performance  Measures  and 
translate  to  a  value 

-Find  “disutility”  for  each  value 

-Find  expected  disutility  values 
by  applying  top  event  frequencies 
for  each  top  event 

-Use  Equation  (1)  to  calculate 
overall  performance  index  values 


Figure  6.1 — Quantitative  Analysis  Approach  to  Rank  Desirability  of  HCU 

Maintenance  Options 


6.3  Method  of  Analysis 


This  section  provides  an  overview  of  how  the  “Utility  Analysis”  is  performed  and 
the  overall  performance  index  values  determined  for  each  decision  option. 


6.3.1  Calculate  Potential  HCU  Failure  Basic  Event  Probabilities 

6.3. 1. 1  Sources  of  Data  and  Assumptions 

As  discussed  in  Section  4.5,  the  basic  event  probabilities  were  determined  from 
NPRDS  data  that  spanned  from  1978-1996.  Although  data  was  not  available  for  a  few 
basic  events,  basic  event  probabilities  could  still  be  assigned  by  assuming  that  similar 
events  had  the  same  basic  event  probabilities.  For  those  events  where  data  was  not 
available  and  there  were  no  similar  events  for  which  the  number  of  occurrences  could  be 
assumed,  we  assigned  one  occurrence  during  the  report  period. 

6. 3. 1. 2  Basic  Events  Attributed  to  Human  Error 


The  following  basic  events  are  directly  attributed  to  human  error: 


-SSPV  fail  to  vent  due  to  improper  substances  used  during  maintenance 
-SSPV  fail  to  vent  due  to  parts  incorrectly  installed/improper  rebuild 
-SSPV  fail  to  vent  due  to  adjustment  errors 

-Scram  Inlet  valve  fails  to  move  due  to  parts  incorrectly  installed/improper  rebuild 
-Scram  Inlet  valve  fails  to  move  due  to  adjustment  errors 

-Scram  Outlet  valve  fails  to  move  due  to  improper  substances  used  during  maintenance 
-Scram  Outlet  valve  fails  to  move  due  to  parts  incorrectly  installed/improper  rebuild 
-Scram  Outlet  valve  fails  to  move  due  to  adjustment  errors 
-Nitrogen  volume  failure  to  detect  leaks  due  to  failure  of  operators* 

-Accumulator  volume  failure  to  detect  leaks  due  to  failure  of  operators* 

-Check  valve  failure  to  due  parts  incorrectly  installed 
-Directional  Control  Valve  failure  due  to  improper  parts  installation 
-Directional  Control  Valve  failure  due  to  improper  adjustment 
-Charging  water  failure  to  restore  flow  path* 

-Charging  water  failure  to  restore  V-l  15  * 

-Charging  water  failure  to  restore  V-l  13* 
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-Failure  to  restore  valves  to  required  positions 
V-101* 

V-102* 

V-103* 

V-105* 

V-107* 

V-112*. 

For  those  items  followed  by  asterisks,  basic  event  probabilities  were  determined  using  the 
Technique  for  Human  Error  Rate  Prediction  (THERP).  The  remaining  basic  event 
probabilities  were  found  from  NPRDS  data  or  from  the  assumptions  stated  above  in 
Section  6.3. 1.1. 

To  account  for  the  increased  stress  levels  experienced  by  maintenance  personnel 
and  operators,  a  performance  shaping  factor  (PSF)  of  (x2)  was  applied  to  the  basic  events 
attributed  to  human  error.  This  factor  was  determined  from  Reference  22  for  moderately 
high  stress  level  conditions. 

6.3.2  Calculate  HCU  System  Failure  Top  Event  probabilities 

Using  the  fault  trees  for  the  following  top  events  of  interest,  the  top  event 
probabilities  were  determined  by  applying  the  rules  of  Boolean  algebra: 

Top  Event  1 :  Excessive  Scram  Time 

Top  Event  2:  Failure  to  Scram 

Top  Event  3:  Inadvertent  Rod  Motion  Inward 

Top  Event  4:  Inadvertent  Rod  Motion  Outward 

Top  Event  5:  Failure  to  Move  Control  Rod  Inward 

Top  Event  6:  Failure  to  Move  Control  Rod  Outward 

Appendix  A  shows  in  detail  the  calculation  of  individual  top  event  probabilities. 

As  seen  in  Appendix  A,  there  are  two  sets  of  top  event  probabilities:  one  is  the 
“BASELINE”  case  and  the  other  is  the  “STRESS”  case  where  a  performance  shaping 
factor  of  (x2)  was  applied  to  basic  events  attributed  to  human  error.  The  “STRESS”  case 
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top  event  probabilities  will  be  utilized  for  the  “Short-Off’  decision  option  (Off-line  HCU 
Maintenance  with  a  shortened  outage).  We  made  the  assumption  that  stress  levels  will  be 
much  higher  in  the  case  of  off-line  HCU  maintenance  during  a  shorter  outage  because 
workers  have  not  only  critical  path  work,  but  also  HCU  maintenance  to  complete  in  a 
compressed  time  period. 

6.3.3  Formulate  Decision  Options 

The  decision  options  and  assumptions  for  each  are  as  follows: 

Long-On:  On-line  HCU  maintenance  with  no  change  in  outage  duration 

—HCU  maintenance  is  performed  on-line  with  no  change  in  outage  duration.  The 
average  outage  duration  for  TEPCO  plants  is  90  days. 

-The  BASELINE  top  event  probabilities  are  used  because  there  is  no  difference 
in  stress  levels  when  doing  HCU  maintenance  on-line  or  off-line  when  the  outage 
durations  are  the  same  for  either  option. 

Long-Off:  Off-line  HCU  maintenance  with  no  change  in  outage  duration 

-HCU  maintenance  is  performed  off-line  with  no  change  in  outage  duration.  The 
average  outage  duration  for  TEPCO  plants  is  90  days. 

-The  BASELINE  top  event  probabilities  are  used  because  there  is  no  difference 
in  stress  levels  when  doing  HCU  maintenance  on-line  or  off-line  when  the  outage 
durations  are  the  same  for  either  option 

Short-On:  On-line  HCU  maintenance  with  a  shortened  outage 

—HCU  maintenance  is  performed  on-line  with  a  shortened  outage  duration. 

-We  assume  the  outage  duration  was  shortened  by  increased  efficiency  in 
completing  critical  path  work  items  and  by  shifting  selected  non-critical  path 
maintenance  on-line.  The  assumed  shortened  outage  duration  is  60  days. 

—The  BASELINE  top  event  probabilities  are  used  because  there  is  no  added  stress 
when  HCU  maintenance  is  performed  on-line  with  a  shortened  outage. 
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Short-Off:  Off-line  HCU  maintenance  with  a  shortened  outage 

-HCU  maintenance  is  performed  off-line  with  a  shortened  outage  duration. 

—We  assume  the  outage  duration  was  shortened  by  increased  efficiency  in 
completing  critical  path  work  items  and  by  shifting  selected  non-critical  path 
maintenance  on-line.  The  assumed  shortened  outage  duration  is  60  days. 

—The  STRESS  top  event  probabilities  are  used  because  the  stress  levels  are 
moderately  higher  when  performing  HCU  maintenance  off-line  during  a  shortened 
outage. 

6.3.4  Calculate  overall  performance  index  values  for  each  decision  option 
considering  both  occurrence  and  avoidance  of  system  failure 

6.3.4. 1  Formulate  Values  for  each  Performance  Measure 

In  this  step,  each  decision  option’s  effect  upon  the  performance  measures  is 
evaluated  in  the  event  that  each  top  event  occurs  and  also  for  the  situation  in  which  no 
top  event  occurs.  Table  6.1  and  6.2  demonstrate  how  this  evaluation  is  formatted  for  both 
the  long  and  short  outage  cases.  Assumptions  were  made  for  the  following  performance 
measures: 

1.  Public  Casualty  (PC):  Since  Loss  of  Reactivity  Control  is  an  initiating  event  with  a 
very  low  probability  of  occurrence  [26],  we  assumed  that  our  decision  options  for  HCU 
maintenance  would  have  a  negligible  effect  upon  Core  Damage  Frequency  (CDF)  and  to 
Large  Early  Release  Frequency  (LERF).  Therefore,  the  values  assigned  are  equal  to  zero 
for  all  four  decision  options  and  each  occurrence  and  non-occurrence  of  a  top  event. 

2.  Worker  Casualty  (WC):  Because  maintenance  on  HCU  components  involves  small 
components  located  relatively  close  to  each  other  and  requires  no  industrial  equipment 
(ie,  lifts,  ladders,  etc),  the  effect  on  the  number  of  worker  casualties  is  negligible. 
Therefore,  the  values  assigned  are  zero  for  all  four  decision  options  and  each  occurrence 
and  non-occurrence  of  a  top  event. 
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3.  Plant  Unavailability  (PU):  For  the  long  outage  cases,  we  assumed  that  the  plant  would 
be  out  of  service  for  90  days  in  order  to  reflect  the  length  of  time  that  the  plant  is  down 
for  outage  maintenance.  In  the  short  outage  cases,  the  plant  would  be  out  of  service  for 
60  days.  In  the  cases  where  a  top  event  occurs,  the  additional  unavailability  would  be  14 
days,  giving  a  total  plant  unavailability  of  104  days  and  74  days  for  the  long  outage  and 
short  outages  cases,  respectively. 

4.  Repair  Cost  (Cost):  For  each  decision  option  should  a  top  event  occur,  the  assumed 
cost  to  fix  the  problem  in  the  HCU  system  that  caused  the  top  event  is  approximately 
Y2.9E6.  The  cost  associated  with  no  top  event  occurring  is  zero. 

i 

5.  Worker  Load:  For  the  “Long-On”  case  where  a  top  event  does  not  occur,  the  assumed 
worker  load  is  equal  to  eight  in  order  to  account  for  the  workers  required  to  perform  on¬ 
line  HCU  maintenance.  In  the  event  that  a  top  event  occurs  in  the  “Long-On”  case,  an 
additional  two  workers  would  be  required  to  fix  the  problem,  giving  a  total  of  10 
workers.  For  the  “Long-Off”  case,  if  no  top  event  occurs,  worker  load  is  zero;  but  when 
a  top  event  does  occur,  two  workers  will  be  required  to  fix  the  problem  that  caused  the 
top  event.  For  the  “Short-On”  case,  the  worker  load  for  the  “no  top-event”  case  is  equal 
to  18  to  account  for  the  number  of  workers  needed  to  perform  HCU  and  other  non-critical 
path  maintenance  on  line.  In  the  case  of  a  top  event  occurring  for  the  “Short-On”  case, 
an  additional  two  workers  are  required.  For  the  “Short-Off”  case,  if  no  top  event  should 
occur,  10  workers  would  be  needed  only  to  perform  the  non-critical  path  maintenance 
that  was  shifted  from  being  performed  off-line  to  being  performed  on-line.  In  the  case  of 
a  top  event  occurring  for  the  “Short-Off”  case,  an  additional  2  workers  would  be  needed, 
giving  a  total  of  12  workers. 

6.  Relationships  with  METI  (METI),  Local  Government  (LG),  and  Media  Coverage 
(MC): 

For  these  performance  measures,  the  expected  reaction  by  each  entity  is  assigned  for  each 
decision  option  under  the  circumstances  of  a  top  event  occurring  and  not  occurring. 


66 


However,  this  assigned  value  is  not  used  to  assign  a  unique  disutility  value  since  the 
expected  reactions  of  the  respective  stakeholders  are  uncertain  and  may  vary.  They  are 
treated  probabilistically.  Section  63.4.2  describes  how  probability  mass  functions  were 
assigned  for  METI,  LG,  and  MC  reactions  to  account  for  the  uncertainty  in  stakeholder 
reactions. 

6. 3. 4. 2  Formulate  Disutilities  for  Each  Value 

The  corresponding  disutilities  for  the  values  assigned  in  the  previous  section  can 
be  found  by  using  the  graphs  of  Sato,  et  al.  (Ref  25).  These  graphs  are  Figures  62-6.9 . 
For  the  performance  measures  METI,  LG,  and  MC,  conditional  probability  values  were 
formulated  to  account  for  the  uncertainties  in  the  reactions  by  each  of  these  stakeholders 
to  the  decision  options  and  occurrence/non-occurrence  of  top  events.  Tables  6.3-6.8 
demonstrate  how  the  expected  values  of  the  disutilities  were  determined.  For  example, 
looking  at  Table  6.3,  for  the  “Long-On”  example  in  the  case  of  Top  Event  1  occurring, 
there  is  a  probability  of  0.6  that  the  relationship  with  METI  will  become  “BAD,”  a 
probability  of  0.3  that  it  will  become  “WEAK,”  and  a  probability  of  0.1  that  it  will 
become  “VERY  BAD.”  The  corresponding  disutility  values  (from  Figure  6.6)  are  0.42, 
0.2,  and  1,  respectively.  Using  the  following  relationship, 

Expected  Disutility  Value  =  £  P  (Sj/T)  X  Disutility  (Si)  [27] 

i  outcome  states 


where  P  (Sj/T)  is  the  probability  of  state,  (Sj),  given  that  a  Top  Event  Occurs 
and  Disutility  (Sj)  is  the  disutility  value  of  a  given  state  (from  Figure  62-6.9). 

The  expected  value  of  the  disutility  of  METI  relationship,  considering  the  “Long-On” 
case  with  Top  Event  1  occurring,  is  0.41.  These  expected  values  of  disutilities  are  used 
in  Tables  6.10-6.1 1  for  both  the  long  outage  and  short  outage  cases. 
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The  following  assumptions  were  made  in  our  work  in  order  to  establish  the  differences  in 
the  probability  mass  functions  between  the  decision  options: 

1 .  Comparing  the  “Long-On”  case  and  “Long-Off”  case  we  use  the  following 
assumptions: 

-The  reaction  by  METI  will  be  slightly  worse  in  the  “Long-On”  case  than  in  the 
“Long-Off”  case  because  the  expectations  for  good  outcomes  are  greater  when  on-line 
HCU  maintenance  is  accepted  by  the  regulator,  resulting  in  a  more  negative  outcome 
should  a  top  event  occur. 

—The  reaction  by  local  government  will  be  slightly  worse  in  the  “Long-Off”  case 
because  there  is  a  lack  of  workers  employed  year-round.  Thus,  should  a  top  event  occur, 
the  LG  reaction  in  the  “Long-Off”  case  will  be  more  negative  compared  to  the  “Long- 
On”  case. 

—Media  Coverage  will  be  more  negative  should  a  top  event  occur  in  the  “Long- 
On”  case  because  the  media  will  be  suspicious  and  wary  of  on-line  HCU  maintenance. 

—Within  the  “Long-On”  case,  the  LG  reaction  will  be  slightly  worse  than  METI 
reaction  due  to  the  local  government’s  suspicion  to  the  new  HCU  on-line  maintenance 
practice. 

—If  no  top  event  occurs,  the  LG  reaction  in  the  “Long-On”  case  will  be  slightly 
better  than  that  in  the  “Long-Off”  case  because  on-line  HCU  maintenance  employs 
workers  year-round  and  does  not  adversely  affect  plant  safety. 


2.  Comparing  the  “Short-On”  case  and  “Short-Off”  case: 

—  The  reaction  by  METI  will  be  slightly  worse  in  the  “Short-On”  case  than  in  the 
“Short-Off”  case  because  the  expectations  are  greater  when  on-line  HCU  maintenance  is 
accepted,  resulting  in  a  more  negative  outcome  should  a  top  event  occur. 

—The  reaction  by  local  government  will  be  slightly  worse  in  the  “Short-Off”  case 
because  there  are  a  fewer  number  of  workers  employed  year-round.  Thus,  should  a  top 
event  occur,  the  LG  reaction  in  the  “Long-Off”  case  will  be  more  negative  compared  to 
the  “Short-On”  case. 
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—If  no  top  event  occurs,  the  reactions  by  METI,  LG,  and  the  media  will  be  more 
positive  for  the  “Short-On”  case  because  on-line  HCU  maintenance  has  enabled  TEPCO 
to  achieve  all  of  its  goals:  reducing  the  outage  duration,  employing  more  workers  year- 
round,  and  maintaining  or  improving  plant  safety. 

3.  Comparing  the  “Long-On”  case  and  “Short-On”  case: 

—The  METI  response  will  be  slightly  worse  for  the  “Short-On”  case  than  the 
“Long-On”  case  because  the  level  of  disappointment  will  be  greater  if  a  top  event  occurs. 
This  is  due  to  the  greater  amount  of  scrutiny  that  METI  experiences  from  the  decision  to 
expand  on-line  maintenance. 

—The  LG  response  to  a  top  event  occurrence  will  be  worse  for  the  “Long-On” 
case  than  the  “Short-On”  case  because  there  are  more  workers  employed  on-line  in  the 
“Short-On”  case,  quelling  LG  suspicion  to  the  new  practice. 

—Media  Coverage,  should  a  top  event  occur,  is  more  negative  for  the  “Short-On” 
case  than  the  “Long-On”  case  because  the  media  see  expansion  of  on-line  maintenance  as 
negatively  affecting  plant  safety. 

4.  Comparing  the  “Long-Off”  case  and  “Short-Off’  case: 

—The  METI  response  will  be  slightly  worse  for  the  “Short-Off’  case  than  the 
“Long-Off’  case  because  of  the  greater  scrutiny  is  faces. 

—The  LG  reaction  in  the  “Short-Off’  case  would  not  be  as  severe  as  the  “Long- 
Off’  case  due  to  the  greater  number  of  workers  employed  on-line. 

—  Media  Coverage,  should  a  top  event  occur,  is  more  negative  for  the  “Short-On” 
case  than  the  “Long-On”  case  because  the  media  see  expansion  of  on-line  maintenance  as 
negatively  affecting  plant  safety. 

6. 3. 4. 3  Calculation  of  Expected  Disutility  Values  for  each  System  Outcome  and  for  each 
Performance  Measure 

The  expected  disutility  values  for  each  System  Outcome  and  for  each 
performance  measure  are  calculated  using  the  values  of  the  disutilities  given  in  Tables 
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6.10-6.1 1  and  multiplied  by  the  respective  probability  of  the  given  top  event  occurring  or 
not  occurring  (P=l).  The  top  event  probabilities  that  are  utilized  are  as  delineated  in 
Section  6.3.3.  Finally,  the  expected  disutility  value  for  each  top  event  is  summed  for 
each  performance  measure.  Figure  6.1 1  shows  how  this  is  done.  The  expected 
disutilities  in  the  highlighted  column  are  summed  to  obtain  an  expected  value  of  2.05E- 
03. 

6. 3. 4. 4  Calculation  of  the  Overall  Performance  Index  Values 

The  overall  performance  index  value  is  calculated  using  the  following  equation: 

pij=Zw«u. 

Plj  =  performance  index  for  the  j,h  decision  option 
Wj  =  weight  of  thei*  PM 

Uy  =  the  utility  for  the  i*  PM  given  by  the  j,h  decision  option  and  the  kth  top  event  outcome 


The  decision  option  having  the  lowest  overall  performance  index  is  the  most 
desirable.  In  order  to  account  for  the  changing  preferences  of  the  decision  maker,  this 
calculation  was  carried  out  using  different  weights.  The  weights  given  in  Section  5.2.2 
were  evaluated  with  the  assumption  that  the  decision  makers  would  distribute  their 
preferences  as  follows:  50%  to  safety,  25%  to  economics,  and  25%  to  relations  to 
stakeholders.  In  a  sensitivity  analysis  we  also  considered  the  following  distribution  of 
preferences: 

•  33/33/33 

•  60/20/20 

•  70/20/10 

•  45/45/10 

•  75/20/5 
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The  corresponding  individual  weights  for  each  performance  measure,  given  the  overall 
weight  preferences  for  safety,  economics,  and  stakeholder  relations  is  shown  in  Table  6.9. 
33/33/33,  50/25/25,  etc.  are  High  Level  Importance  Weights  and  the  numbers  below  each 
performance  measure  (PC,  WC,  PU,  etc.)  are  Individual  Metric  Importance  Weights. 


INDIVIDUAL  METRIC  IMPORTANCE  WEIGHTS  FOR  EACH  PM 

HIGH  LEVEL 

IMPORTANCE 

WEIGHTS 

PC 

WC 

PU 

COST 

METI 

LG 

WL 

MC 

33/33/33 

0.22 

0.11 

0.149 

0.181 

0.066 

0.066 

0.132 

0.066 

50/25/25 

0.333 

0.167 

0.113 

0.138 

0.05 

0.05 

0.01 

0.05 

60/20/20 

0.4 

0.2 

0.09 

0.11 

0.02 

0.04 

0.08 

0.04 

70/20/10 

0.466 

0.234 

0.09 

0.11 

0.02 

0.02 

0.04 

0.02 

45/45/10 

0.3 

0.15 

0.203 

0.247 

0.02 

0.02 

0.04 

0.02 

75/20/5 

0.5 

0.251 

0.09 

0.11 

0.01 

0.01 

0.02 

0.01 

Table  6.9 — Weights  of  Individual  Performance  Measures,  given  Overall  Decision 
Maker  Preferences  concerning  Safety,  Economics,  and  Stakeholder  Relations  [28] 
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DECISION  OPTION 
&  TOP  EVENTS 


VALUES  FOR  PERFORMANCE  MEASURES 
IN  CASE  OF  TOP  EVENT  OCCURRING 


DECISION  OPTION  VALUES  FOR  PERFORMANCE  MEASURES 

IN  CASE  OF  NO  TOP  EVENT  OCCURRING 


Table  6.1 — Values  for  Performance  Measures  (Long  Outage  Case) 
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DECISION  OPTION  &  VALUES  FOR  PERFORMANCE  MEASURES 


TOP  EVENT  IN  CASE  OF  TOP  EVENT  OCCURRING 


SHORT-ON 

PC 

wc 

PU 

COST 

METI 

LG 

WL 

MC 

TE1 

0 

0 

74 

2.85E+06 

Weak 

Weak 

20 

Bad 

TE2 

0 

0 

74 

2.85E+06 

Bad 

Bad 

20 

Bad 

TE3 

0 

0 

74 

2.85E+06 

Weak 

Weak 

20 

Bad 

TE4 

0 

0 

74 

2.85E+06 

Bad 

Bad 

20 

Bad 

TE5 

0 

0 

74 

2.85E+06 

Bad 

Bad 

20 

Bad 

TE6 

0 

0 

74 

2.85E+06 

Weak 

Weak 

20 

Bad 

SHORT-OFF 

PC 

wc 

PU 

COST 

MET! 

LG 

WL 

MC 

TE1 

0 

0 

74 

2.85E+06 

Weak 

Bad 

12 

Weak 

TE2 

0 

0 

74 

2.85E+06 

Bad 

Very  Bad 

12 

Weak 

TE3 

0 

0 

74 

2.85E+06 

Weak 

Bad 

12 

Weak 

TE4 

0 

0 

74 

2.85E+06 

Bad 

Very  Bad 

12 

Weak 

TE5 

0 

0 

74 

2.85E+06 

Bad 

Very  Bad 

12 

Weak 

TE6 

0 

0 

74 

2.85E+06 

Weak 

Bad 

12 

Weak 

DECISION  OPTION  VALUES  FOR  PERFORMANCE  MEASURES 


IN  CASE  OF  NO  TOP  EVENT  OCCURRING 


PC 

wc 

PU 

COST 

METI 

LG 

WL 

MC 

SHORT-ON 

0 

0 

60 

0 

Good 

Good 

18 

Good 

SHORT-OFF 

0 

0 

60 

0 

Good 

Good 

10 

Good 

Table  6.2 — Values  for  Performance  Measures  (Short  Outage  Case) 
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Table  6.3— Conditional  Probabilities  and  Associated  Disutilities  of  Stakeholder  Reactions  in  case  of  Top  Event  Occurrence 

(Long-On) 


TOP  EVENT  1  OCCURRING  TOP  EVENT  2  OCCURRING  TOP  EVENT  3  OCCURRING  TOP  EVENT  4  OCCURRING  TOP  EVENT  5  OCCURRING  TOP  EVENT  $  OCCURRING 


0.04  Very  bad  1  0.04  Very  bad  1  0.04  Very  bad  1  0.04  Very  bad  1  0.04  Very  bad  1  0.04  Very  bad 

lisiiMty*  *  o! 287251  ’028725  \<Dl3UtUfiy>  0,237251  <D!suWiy>  "0.28725  *028721  <Dfruti/fty>  ~  *"  * 

Table  6.4—  Conditional  Probabilities  and  Associated  Disutilities  of  Stakeholder  Reactions  in  case  of  Top  Event  Occurrence  (Long-Off) 


TOP  EVENT  1  OCCURRING  TOP  EVENT  2  OCCURRING  TOP  EVENT  3  OCCURRING  TOP  EVENT  4  OCCURRING  TOP  EVENT  S  OCCURRING  TOP  EVENT  6  OCCURRING 


Table  6.5--  Conditional  Probabilities  and  Associated  Disutilities  of  Stakeholder  Reactions  in  case  of  Top  Event  Occurrence  (Short-On) 


TOP  EVENT  1  OCCURRING  TOP  EVENT  2  OCCURRING  TOP  EVENT  3  OCCURRING  TOP  EVENT  4  OCCURRING  TOP  EVENT  S  OCCURRING  TOP  EVENT  «  OCCURRING 


Table  6.6 — Conditional  Probabilities  and  Associated  Disutilities  of  Stakeholder  Reactions  in  Case  of  Top  Event  Occurrence  (Short-Off) 


Table  6.8 — Conditional  Probabilities  and  Associated  Disutilities  of  Stakeholder  Relations  in  case  of  No  Top  Event  Occurrence  (Short  Outage) 
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CORRESPONDING  DISUTILITIES  FOR  EACH  PM 


DECISION  OPTION  IN  CASE  OF  TOP  EVENT  OCCURRING 


LONG-ON 

PC  WC 

PU 

COST 

METI 

LG 

WL 

MC 

TE1 

0 

0 

0.095 

0 

0.412 

0.59175 

0.0737 

0.57035 

TE2 

0 

0 

0.095 

0 

0.434 

0.4104 

0.0737 

0.57035 

TE3 

0 

0 

0.095 

0 

0.412 

0.59175 

0.0737 

0.57035 

TE4 

0 

0 

0.095 

0 

0.434 

0.4104 

0.0737 

0.57035 

TE5 

0 

0 

0.095 

0 

0.434 

0.4104 

0.0737 

0.57035 

TE6 

0 

0 

0.095 

0 

0.412 

0.59175 

0.0737 

0.57035 

LONG-OFF 

PC 

WC 

PU 

COST 

METI 

LG 

WL 

MC 

TE1 

0 

0 

0.095 

0 

0.34075 

0.4386 

0.315 

0.28725 

TE2 

0 

0 

0.095 

0 

0.412 

0.8039 

0.315 

0.28725 

TE3 

0 

0 

0.095 

0 

0.34075 

0.4386 

0.315 

0.28725 

TE4 

0 

0 

0.095 

0 

0.412 

0.8039 

0.315 

0.28725 

TE5 

0 

0 

0.095 

0 

0.412 

0.8039 

0.315 

0.28725 

TE6 

0 

0 

0.095 

0 

0.34075 

0.4386 

0.315 

0.28725 

CORRESPONDING  DISUTILITIES  FOR  EACH  PM 


IN  CASE  OF  NO  TOP  EVENT  OCCURRING 


DECISION  OPTION 

PC  WC 

PU 

COST 

METI 

LG 

WL 

MC 

LONG-ON 

0 

0 

0.0702 

0 

0.06625 

0.025 

0.0742 

0.06625 

LONG-OFF 

0 

0 

0.0702 

0 

0.06625 

0.06625 

1 

0.06625 

Table  6.10 — Corresponding  Disutilities  (Long  Outage  Case) 
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CORRESPONDING  DISUTILITIES 

DECISION  OPTION  IN  CASE  OF  TOP  EVENT  OCCURRING 


SHORT-ON 

PC  WC 

PU 

COST 

METI 

LG 

WL 

MC 

TE1 

0 

0 

0.061 

0 

0.583 

0.4117 

0 

0.85525 

TE2 

0 

0 

0.061 

0 

0.405 

0.4386 

0 

0.85525 

TE3 

0 

0 

0.061 

0 

0.583 

0.4386 

0 

0.85525 

TE4 

0 

0 

0.061 

0 

0.405 

0.4104 

0 

0.85525 

TE5 

0 

0 

0.061 

0 

0.405 

0.4386 

0 

0.85525 

TE6 

0 

0 

0.061 

0 

0.583 

0.4117 

0 

0.85525 

SHORT-OFF 

PC  WC 

PU 

COST 

METI 

LG 

WL 

MC 

TE1 

0 

0 

0.061 

0 

0.3865 

0.3566 

0.042 

0.44235 

TE2 

0 

0 

0.061 

0 

0.583 

0.73275 

0.042 

0.44235 

TE3 

0 

0 

0.061 

0 

0.3865 

0.73275 

0.042 

0.44235 

TE4 

0 

0 

0.061 

0 

0.583 

0.84555 

0.042 

0.44235 

TE5 

0 

0 

0.061 

0 

0.583 

0.73275 

0.042 

0.44235 

TE6 

0 

0 

0.061 

0 

0.3865 

0.3566 

0.042 

0.44235 

CORRESPONDING  DISUTILITIES 


IN  CASE  OF  NO  TOP  EVENT  OCCURRING 


DECISION  OPTION 

PC  WC 

PU 

COST 

METI 

LG 

WL 

MC 

SHORT-ON 

0 

0 

0.0536 

0 

0.025 

0.025 

0.015 

0.025 

SHORT-OFF 

0 

0 

0.0536 

0 

0.06625 

0.186 

0.0737 

0.06625 

Table  6.11 — Corresponding  Disutilities  (Short  Outage  Case) 
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DISUTILITY*FREQUENCY  (EXPECTED  DISUTILITY) 


DECISION  OPTION  IN  CASE  OF  TOP  EVENT  OCCURRING 


LONG-ON 

PC 

wc 

PU 

COST 

METI 

LG  WL 

MC 

TE1 

0.00E+00  O.OOE+OO 

7.83E-04 

O.OOE+OO 

3.39E-03 

4.88E-03  6.07E-04 

4.70E-03 

TE2 

0.00E+00  0.00E+00 

3.40E-06 

O.OOE+OO 

1.56E-05 

1.47E-05  2.64E-06 

2.04E-05 

TE3 

O.OOE+OO  0.00E+00 

1.49E-04 

O.OOE+OO 

6.45E-04 

9.26E-04  1.15E-04 

8.93E-04 

TE4 

0.00E+00  0.00E+00 

1.48E-21 

O.OOE+OO 

6.76E-21 

6.39E-21  1.15E-21 

8.88E-21 

TE5 

O.OOE+OO  O.OOE+OO 

7.05E-04 

O.OOE+OO 

3.22E-03 

3.05E-03  5.47E-04 

4.23E-03 

TE6 

SUM 

O.OOE+OO  O.OOE+OO 

O.OOE+OO  0 

4.08E-04 

2.05E-03 

O.OOE+OO 

0 

1.77E-03 

9.04E-03 

2.54E-03  3.16E-04  2.45E-03 

0.01 1401 3  0.001 5884  0.0122923 

LONG-OFF 

PC 

wc 

PU 

COST 

METI 

LG  WL 

MC 

TE1 

0 

0 

0.000782794  O.OOE+OO 

2.81  E-03 

3.61  E-03  0.0025956  2.37E-03 

TE2 

0 

0 

3.40435E-06  O.OOE+OO 

1.48E-05 

2.88E-05  1 . 1 29E-05 

1.03E-05 

TE3 

0 

0 

0.000148709  O.OOE+OO 

5.33E-04 

6.87E-04  0.0004931 

4.50E-04 

TE4 

0 

0 

1.47932E-21  O.OOE+OO 

6.42E-21 

1.25E-20  4.905E-21 

4.47E-21 

TE5 

0 

0 

0.000704971  O.OOE+OO 

3.06E-03 

5.97E-03  0.0023375  2.13E-03 

TE6 

0 

0 

0.000407587  O.OOE+OO 

1.46E-03 

1.88E-03  0.0013515 

1.23E-03 

SUM 

0 

0 

0.002047465 

0  0.00787520.0121767  0.006789  0.0061909 

DISUTILITY*FREQUENCY 
IN  CASE  OF  NO  TOP  EVENT  OCCURRING 

DECISION  OPTION 

PC 

wc 

PU 

COST 

METI 

LG  WL 

MC 

LONG-ON 

0 

0 

0.0702 

0 

0.06625 

0.025  0.0742 

0.06625 

LONG-OFF 

0 

0 

0.0702 

0 

0.06625 

0.06625  1 

0.06625 

Table  6.12 — Expected  Disutilities  (Long  Outage  Case) 
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DISUTILITY*FREQUENCY  (EXPECTED  DISUTILITY) 


DECISION  OPTION  IN  CASE  OF  TOP  EVENT  OCCURRING 


SHORT-ON 

PC  WC  PU  COST  METI  LG  WL  MC 

TE1 

O.OOE+OO  0.00E+00  5.03E-04  0.00E+00  4.80E-03  3.39E-03  0.00E+00  7.05E-03 

TE2 

O.OOE+OO  0.00E+00  2.19E-06  0.00E+00  1.45E-05  1.57E-05  0.00E+00  3.06E-05 

TE3 

0.00E+00  O.OOE+OO  9.55E-05  O.OOE+OO  9.13E-04  6.87E-04  O.OOE+OO  1.34E-03 

TE4 

O.OOE+OO  O.OOE+OO  9.50E-22  O.OOE+OO  6.31  E-21  6.39E-21  O.OOE+OO  1.33E-20 

TE5 

O.OOE+OO  O.OOE+OO  4.53E-04  O.OOE+OO  3.01  E-03  3.25E-03  O.OOE+OO  6.35E-03 

TE6 

SUM 

O.OOE+OO  O.OOE+OO  2.62E-04  O.OOE+OO  2.50E-03  1.77E-03  O.OOE+OO  3.67E-03 

0  0  0.001315  0  0.011238  0.009116  0  0.018433 

SHORT-OFF 

PC  WC  PU  COST  METI  LG  WL  MC 

TE1 

O.OOE+OO  O.OOE+OO  6.03E-04  O.OOE+OO  3.82E-03  3.53E-03  4.15E-04  4.38E-03 

TE2 

O.OOE+OO  O.OOE+OO  3.62E-06  O.OOE+OO  3.46E-05  4.34E-05  2.49E-06  2.62E-05 

TE3 

O.OOE+OO  O.OOE+OO  1 .43E-04  O.OOE+OO  9.09E-04  1.72E-03  9.88E-05  1.04E-03 

TE4 

O.OOE+OO  O.OOE+OO  2.28E-21  O.OOE+OO  2.1 8E-20  3.1 6E-20  1.57E-21  1.65E-20 

TE5 

O.OOE+OO  O.OOE+OO  5.73E-04  O.OOE+OO  5.48E-03  6.88E-03  3.94E-04  4.15E-03 

TE6 

SUM 

O.OOE+OO  O.OOE+OO  3.81  E-04  O.OOE+OO  2.41  E-03  2.23E-03  2.62E-04  2.76E-03 

0  0  0.001704  0  0.012656  0.014403  0.001173  0.012359 

DISUTILITY*FREQUENCY 
IN  CASE  OF  NO  TOP  EVENT  OCCURRING 


DECISION  OPTION 

!  PC 

WC 

PU 

COST  METI 

LG 

WL 

MC 

SHORT-ON 

0 

0 

0.0536 

0  0.025 

0.025 

0.015 

0.025 

SHORT-OFF 

0 

0 

0.0536 

0  0.06625 

0.186 

0.0737 

0.06625 

Table  6.13 — Expected  Disutilities  (Short-Outage  Case) 
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*  Figure  6.3 — Disutility  Function  for  Worker  Casualty  (WC)  [25] 


Disutility  Function  for  "Plant 
Unavailability" 


*  Figure  6.4 — Disutility  Function  for  Plant  Unavailability  (PU)  [25] 


Disutility  Function  for  "Repair  Cost 


*  Figure  6.5 — Disutility  Function  for  Repair  Cost  (Cost)  [25] 
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'Figure  6.6 — Disutility  Function  for  “Relationship  with  METI 
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*  Figure  6.7 — Disutility  Function  for  “Relationship  with  Local  Government” 
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*  Figure  6.8 — Disutility  Function  for  “Relationship  with  Local  Workers 
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Figure  6.9 — Disutility  Function  for  Media  Coverage  (MC)  [25] 
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Interpretation  of  Results 

7.1  Introduction 

Using  HCU  maintenance  as  a  case  study  for  application  of  Multi- Attribute  Utility 
Theory,  the  following  decision  options  were  considered  for  TEPCO: 

Long-On:  On-line  HCU  maintenance  with  no  change  in  outage  duration 
Long-Off:  Off-line  HCU  maintenance  with  no  change  in  outage  duration 
Short-On:  On-line  HCU  maintenance  with  a  shortened  outage 
Short-Off:  Off-line  HCU  maintenance  with  a  shortened  outage 

Because  no  failure  data  were  available  from  TEPCO,  we  utilized  NPRDS  failure  data 
from  four  US  BWR  plants:  Brunswickl,  Peach  Bottom  3,  Quad  Cities  1,  and 
Susquehanna  1 .  The  method  of  analysis  described  in  Section  6  was  used  to  calculate  the 
overall  performance  index  for  each  decision  option  and  considers  both  the  occurrence  and 
non-occurrence  of  an  HCU  top  event. 

7.2  Results 

Figure  7.1  shows  the  overall  performance  index  profile  for  the  Brunswick  1  NPS, 
considering  various  importance  weightings  of  performance  measure  categories  and 
occurrence  and  non-occurrence  of  system  failure.  The  order  of  preference  for  the 
decision  options  is  1)  Short-On,  2)  Long-On,  3)  Short-Off,  and  4)  Long-Off;  except  for 
the  45/45/10  distribution  where  the  order  of  preference  is  1)  Short-On,  2)  Short-Off,  3) 
Long-On,  and  4)  Long-Off. 
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7.3  Interpretation  of  Results 


73.1  Ranking  of  Options 

A  use  of  the  AHP  is  obtaining  the  rank  order  of  attractiveness  of  the  decision 
options.  The  results  of  this  study  indicate  that  the  current  practice  (“Long-Off’)  of 
performing  HCU  maintenance  off-line  during  Japan’s  long  outage  durations  is  the  least 
preferred  option.  Based  upon  the  analysis  results  shown  in  Figure  7.1,  the  best  option  is 
“Short-On”  (On-line  HCU  maintenance  with  a  shortened  outage)  and  the  worst  option  is 
“Long-Off’  (Off-line  HCU  maintenance  with  a  long  outage). 

The  “Long-On”  and  “Short-Off’  options  can  interchange  ranking  based  upon  the 
weighting  of  decision  maker  preference  to  safety,  economics,  and  stakeholder  relations 
[as  seen  in  45/45/10  where  the  ranking  is  1)  Short-On,  2)  Short-Off,  3)  Long-On,  4) 
Long-Off).  The  “Performance  Index  Value”  axis  on  the  graph  represents  the  overall 
performance  index  calculated  for  each  decision  option.  The  “Weighting”  axis  represents 
the  various  weights  considered  to  reflect  the  decision  maker’s  preferences  toward  safety, 
economics,  and  stakeholder  relations.  For  example,  for  the  50/25/25  weighting,  the 
decision  maker  places  50%  of  the  importance  to  safety,  25%  to  economics,  and  25%  to 
stakeholder  relations. 

The  major  factors  affecting  the  overall  performance  index  value  are  shown  in 
Figure  7.2  and  Figure  7.3,  where  we  considered  the  weighting  of  50%  to  safety,  25%  to 
economics,  and  25%  to  stakeholders.  The  column  heights  represent  the  utility  multiplied 
by  the  assigned  weight  for  the  performance  measure.  Thus  the  height  of  the  column  is 
directly  proportional  to  the  level  of  disfavor  (i.e.  disutility)  with  regard  to  the  given 
performance  measure.  Looking  at  Figure  7.2  and  considering  each  performance  measure 
individually,  the  most  favorable  decision  option  is  as  follows: 
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1 .  PU:  Short-On,  indicating  that  this  decision  option  yields  the  lowest  plant 
unavailability. 

2.  METI  and  MC:  Long-Off,  indicating  that  the  relationship  with  METI  and  the  media 
is  best  when  the  current  HCU  maintenance  practice  is  maintained. 

3.  LG  and  WL:  Short-On,  indicating  that  the  local  government  and  local  community 
are  pleased  when  workers  are  employed  year  round. 


7.3.2  Identification  of  Factors  that  Can  Improve  a  Decision  Option’s  Attractiveness 

A  valuable  use  of  MAUT  is  the  identification  of  the  performance  metrics  which 
would  be  valuable  to  improve  in  rendering  a  particular  decision  option  more  attractive. 
The  cases  of  both  occurrence  and  avoidance  of  system  failures  (Figure  7.4)  are 
considered  and  the  combination  of  both  yields  a  chart  similar  to  Figure  7.3. 

Consequently,  Figure  7.3  can  be  used  exclusively  to  determine  the  major  factors  affecting 
the  overall  performance  index.  It  can  be  seen  that  stakeholder  relations  (METI,  LG,  WL, 
and  MC)  and  plant  unavailability  are  the  major  contributors  to  the  overall  performance 
index,  with  “Worker  Load”  and  “Plant  Unavailability”  playing  the  most  significant  roles 
in  establishing  the  “Long-Off’  option  as  the  most  unfavorable. 

Knowing  that  “Worker  Load”  and  “Plant  Unavailability”  are  responsible  for  the 
high  performance  index  of  the  “Long-Off’  option,  the  utilities  can  make  the  “Long- 
OfF’option  more  attractive  by  making  efforts  to  improve  the  “Worker  Load”  and  “Plant 
Unavailability.”  Figure  7.2  is  a  good  representation  of  how  MAUT  can  be  used  to 
understand  better  how  the  individual  performance  measures  are  impacted  by  the  decision 
options  available.  This  knowledge  allows  the  decision  maker  to  identify  the  areas  in 
which  a  decision  option  can  be  improved.  For  example,  referring  to  Figure  4,  the  “Short- 
On”  decision  option  can  be  made  more  attractive  by  making  improvements  in  “Relations 
with  METI”  and  “Media  Coverage.”  The  improvements  in  these  two  areas  would  lower 
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the  overall  performance  index  of  the  option,  making  it  more  attractive  to  the  decision 
makers  and  stakeholders. 

As  mentioned  earlier,  “Long-On”  and  “Short-Off”  can  interchange  ranking  based 
on  the  weighting  of  decision  maker  preferences  to  safety,  economics,  and  stakeholder 
relations.  Figures  7.5  and  7.6  demonstrate  how  this  occurs  when  we  consider  the 
weightings  50/25/25  and  45/45/10.  As  can  be  seen  from  this  Figure  7.5,  stakeholder 
relations  play  a  significant  role  in  differentiating  between  “Long-On”  and  “Short-Off.” 
In  the  50/25/25  case,  “Long-On”  is  the  preferred  option  over  “Short-Off”.  However,  in 
the  45/45/10  case,  Plant  Unavailability  has  the  dominant  effect  on  the  overall 
performance  index.  Consequently,  “Short-Off”  is  the  preferred  option  over  “Long-On” 
in  Figure  7.6. 
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Overall  Performance  Index  Values  for  Various  Weightings  of  Performance  Measure 
Considering  Both  Occurrence  and  Avoidance  of  System 


Figure  7.1 — Overall  Performance  Index  Values  for  Various  Weightings  of  Performance  Measure  Categories  (Brunswick  1) 


Figure  7.2--  Contributions  to  Overall  Performance  Index  In  Event  of  System  Failure 


o 

(N 


Economics;  25%  Stakeholders  In  the  Event  of  No  System  Failure 


Figure  7.3—  Contributions  to  Overall  Performance  Index  In  Event  of  No  System  Failure 


50%  Safety;  25%  Economics;  25%  Stakeholders 
Combination  of  Occurrence  and  Avoidance  of  Top  Event 
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ure  7.4 — Total  Contributions  to  Overall  Performance  Index  Probability- Weigh  ted  (Combination  of  Occurrence  and 

Avoidance  of  System  Failure) 


Economics:  25%  Stakeholders 


Figure  7.5 — Influence  of  Stakeholder  Relations  in  Differentiating  Between  “Long-On”  and  “Short-Off’  (50/25/25) 


Economics:  10%  Stakeholders 
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Concluding  Remarks 


8.1  Summary  of  Results 

By  switching  to  on-line  HCU  maintenance,  US  plants  have  1)  managed  to  shorten 
plant  outage  durations,  2)  lowered  costs  associated  with  refueling  maintenance,  3) 
allowed  more  resources  to  be  devoted  to  critical  path  items  during  refueling,  and  4) 
employed  more  in-house  plant  personnel  in  the  performance  of  HCU  maintenance. 
Although  this  decision  has  produced  significant  benefits  to  the  utilities,  the  decision  to 
shift  on-line  was  based  solely  upon  a  deterministic  analysis,  using  expert  judgment  and 
ensuring  compliance  with  the  Technical  Specifications. 

With  the  use  of  Multi-Attribute  Utility  Theory,  decision  makers  at  TEPCO  have  a 
method  by  which  they  are  able  to  carefully  consider  the  HCU  maintenance  decision 
options  available  to  them.  This  method  allows  them  to  tailor  their  preferences  for  safety, 
economics,  and  relations  to  stakeholders;  and  it  provides  a  rank  ordering  of  the 
desirability  of  each  decision  option.  MAUT  can  be  also  be  used  to  better  understand  how 
the  individual  performance  measures  are  impacted  by  the  decision  options  available. 

This  knowledge  allows  the  decision  maker  to  identify  the  areas  in  which  a  decision 
option  can  be  valuably  improved. 

The  results  of  our  study  indicate  that  the  current  practice  of  performing  HCU 
maintenance  off-line  during  TEPCO’ s  long  outage  durations  is  the  least  preferred  option. 
Although  the  most  preferred  option  is  to  perform  HCU  maintenance  on-line  during  a 
shorter  duration  outage,  this  decision  option  is  the  most  difficult  to  implement  because 
the  number  of  changes  requiring  management  by  the  utility  is  greatest.  These  changes 
include  shortening  outage  durations  by  shifting  non-critical  path  maintenance  items  on¬ 
line,  including  HCU  maintenance;  and  revamping  its  approach  to  critical  path  work  by 
reducing  the  time  required  to  complete  critical  path  items. 
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More  realistic  alternatives  are  the  “Long-On”  and  “Short-Off’  options  because  the 
number  of  changes  that  a  utility  must  implement  are  fewer  than  in  the  “Short-On”  option. 
Either  the  “Long-On”  or  “Short-Off’  option  would  be  more  likely  to  be  accepted  because 
either  option  would  produce  benefits  consistent  with  the  following  goals: 

1 .  To  shorten  the  duration  of  outages. 

2.  To  assure  that  maintenance  takes  place  year-round,  employing  workers  from  the  local 
community  year-round,  thus  improving  relations  with  the  local  government  and  public. 

3.  To  enhance  the  competitiveness  and  safety  of  the  nuclear  power  plants  from  the 
perspective  of  cost,  using  risk  information. 

8.2  Issues  and  Limitations 

The  analysis’  results  depend  upon  underlying  assumptions  regarding  the  data 
employed  and  each  decision  option’s  influence  upon  the  performance  measures. 
Consequently,  these  assumptions  place  some  limitations  on  the  precision  of  the 
calculated  overall  performance  index  value  and  the  ranking  of  decision  options. 

First,  the  data  gathered  from  the  NPRDS  database  covering  HCU  failures  are  not 
comprehensive,  and  assumptions  had  to  be  made  with  regard  to  the  frequency  of 
occurrence  of  some  basic  events.  In  addition,  the  human  error  probability  analysis 
depended  upon  the  THERP  and  the  modification  factors  obtained  from  Swain,  et  al. 
(1980)  The  human  error  probability  estimates  and  performance  shaping  factors  provided 
in  Reference  22  were  based  upon  the  experience  of  the  authors,  and  the  calculated  top 
event  probabilities  are  based  upon  US  utility  data.  As  a  result,  the  specific  conditions  at 
TEPCO  were  not  accounted  for  in  our  study. 
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The  analysis  also  employs  a  number  of  subjective  judgments  based  on  the 
expertise  of  a  visiting  TEPCO  engineer.  These  judgments  were  used  to  estimate 
stakeholder  reactions  to  the  occurrence  and  non-occurrence  of  a  top  event,  in  light  of  the 
decision  options  being  considered.  In  addition,  subjective  judgments  were  used  to  make 
assumptions  regarding  the  effect  of  the  decision  options  on  the  following  performance 
measures:  public  casualty,  worker  casualty,  repair  cost,  and  plant  unavailability.  Clearly, 
these  judgments  need  to  be  reviewed  before  making  a  serious  evaluation  of  the  decision 
options  available  for  HCU  maintenance.  TEPCO  decision  makers  must  carefully 
consider  their  preferences  with  regard  to  safety,  economics,  and  stakeholder  relations  and 
honestly  evaluate  the  effect  of  the  decision  options  on  each  performance  measure. 

8.3  Applications 

This  study,  despite  limitations  presented  by  data  and  subjective  judgments, 
provides  a  reasonable  indication  of  the  desirability  of  various  HCU  maintenance  decision 
options.  The  use  of  MAUT  allows  the  decision  makers  to  consider  not  only  safety  and 
economics  but  also  the  impact  on  stakeholder  relations.  This  formal  analysis  will  1) 
enhance  consensus  building,  2)  provide  a  systematic  method  for  processing  a  large 
amount  of  information,  3)  provide  formal  rules  for  quantifying  preferences,  and  4) 
enhance  the  decision-making  process  by  improving  communication  between  decision 
makers.  It  is  a  valuable  tool  that  can  be  applied  to  evaluate  any  decision  option  in  light  of 
the  primary  goals  delineated  by  the  decision  makers. 
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Appendix  A:  Fault  Trees  and  Top  Event  Probability  Data 

This  section  contains  complete  fault  trees  for  the  top  events  considered  for  our 
study.  The  fault  tree  for  Top  Event  6  is  omitted  because  it  is  almost  identical  to  the  fault 
tree  for  Top  Event  5.  Also  included  in  this  section  are  HCU  failure  data  from  four  US 
Nuclear  Power  Plants:  Brunswick  1,  Peach  Bottom  3,  Quad  Cities  1,  and  Susquehanna  1. 
These  data  were  obtained  from  the  Nuclear  Plant  Reliability  Data  System  (NPRDS).  All 
HCU  basic  events  are  listed  along  with  their  probabilities  of  occurrence  (the  method  of 
calculation  is  presented  in  Section  4.5).  The  basic  event  probabilities  are  then  used  to 
calculate  the  top  event  probabilities  (using  Boolean  algebra)  that  are  utilized  to  find  the 
overall  performance  index  values  for  each  decision  option  considered. 

Figure  Title 

A.  1  Fault  Tree  for  Top  Event  1  (Excessive  Scram  Time) 

A.2  Fault  Tree  for  Top  Event  2  (Failure  to  Scram) 

A.3  Fault  Tree  for  Scram  Outlet/Inlet  Valve  Failure  to  Open 

A.4  Fault  Tree  for  Accumulator  Leaks  and  Failure  to  Detect  Leaks 

A.  5  Fault  Tree  for  Top  Event  3  (Inadvertent  Rod  Motion  Inward) 

A.6  Fault  Tree  for  Top  Event  4  (Inadvertent  Rod  Motion  Outward) 

A.7  Top  Event  5  (Rod  Fails  to  Move  Inward) 

Table  Title 

A.  1  Brunswick  1  Basic  Event  and  Top  Event  Probability  Data 

A.2  Peach  Bottom  3  Basic  Event  and  Top  Event  Probability  Data 

A.3  Quad  Cities  1  Basic  Event  and  Top  Event  Probability  Data 

A.4  Susquehanna  1  Basic  Event  and  Top  Event  Probability  Data 

Notes:  1 .  Failure  rates  are  in  number  of  occurrences  per  year  (#occurrences/yr). 

2.  “H”=  Failures  attributed  to  human  error 

3.  Number  of  service  failures  equals  number  of  times  basic  event  occurred  within  report 
interval. 
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EXCESSIVE  SCRAM 
TIME 


Figure  A.  I — Top  Event  1  (Excessive  Scram  Time) 


FAILURE  TO 
SCRAM  CONTROL 


Figure  A.2 — Top  Event  2  (Failure  to  Scram) 


INADVERTENT  ROD 
MOTION  INWARD 


Figure  A.5 — Top  Event  3  (Inadvertent  Rod 
Motion  Inward) 


INADVERTENT  ROD 
MOTION  OUTWARD 


Figure  A.6 — Top  Event  4  (Inadvertent 
Rod  Motion  Outward) 


tOD  FAILS  TO  MOVE 
INWARD  (NORMAL 
MOTION) 
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Figure  A.7 — Top  Event  5  (Rod  Fails  to  Move 
Inward) 
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